.. / CVE-2019-14530

• LFI
• Nuclei
• Web

Exploit for OpenEMR <5.0.2 - Local File Inclusion (CVE-2019-14530)

Description:

OpenEMR before 5.0.2 is vulnerable to local file inclusion via the fileName parameter in custom/ajax_download.php. An attacker can download any file (that is readable by the web server user) from server storage. If the requested file is writable for the web server user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, the file will be deleted from server.

Nuclei Template

View the template here CVE-2019-14530.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2019/CVE-2019-14530.yaml

References: