Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2019-14529 — OpenEMR Security issue | Kitploit
Tools/GitHubGitHub/wezery/cve-2019-14529
Vulnerability AnalysisWeb Application ExploitationInformation GatheringPenetration TestingDatabase Security
GitHubwezery/cve-2019-14529

CVE-2019-14529

OpenEMR Security issue

View Repository
136 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2019-14529

Multiple SQL Injection vulnerability in OpenEMR project

Vulnerable function in file: /openemr/interface/forms/eye_mag/save.php

Conditions : any authorized user

Vulnerable versions: <5.0.2, Fixed in 5.0.2 version.

Description

There are two functions:

  1. "store_PDF", with non filtered variable "encounter",
  2. "canvas", with non two filtered variable "encounter" and "zone".

Both functions use this variables in DELETE sql query without any filtration. Both variables controlled by attacker.

Error messages contains code of SQL queries and SQL error message. It can be used for exploit error-based type of SQL Injection.

Impact

Disclosure of VERY sensitive information, since this software used in medical sphere.

Other

OpenEMR official site

OpenEMR git repo

Patch for this issue

P.S. Special thanks to Brady G. Miller from OpenEMR team for fast response and patches

Download Tool