Arbitrary File Read Vulnerability in OpenEMR Patient Portal

CVE-2018-15140 · MEDIUM Severity

AV:N/AC:L/AU:S/C:P/I:N/A:N

Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to read arbitrary files via the "docid" parameter when the mode is set to get.

Learn more about our Web Application Penetration Testing UK.