Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.5
CVE-2012-0992: OpenEMR 4.1.0 lets logged‑in users run commands
CVE-2012-0992 · published 14 years ago
Summary
In OpenEMR version 4.1.0, a logged‑in user can place special characters in the file name used by the fax dispatch page, causing the system to execute unintended commands. This could allow the attacker to control the server or access sensitive data. Apply the available security update or limit access to the fax module until the patch is installed.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| openemr | openemr |
4.1.0 cpe:2.3:a:openemr:openemr:4.1.0:*:*:*:*:*:*:* |
Original advisory text
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter.
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter.
References
- http://archives.neohapsis.com/archives/bugtraq/2012-02/0004.html Patch Vendor Advisory
- http://osvdb.org/78731
- http://secunia.com/advisories/47781 Vendor Advisory
- http://www.open-emr.org/wiki/index.php/OpenEMR_Patches Patch
- http://www.securityfocus.com/bid/51788 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/72915
- https://www.htbridge.ch/advisory/HTB23069 Exploit
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
8.5
High
Type
CWE-20Improper Input Validation
Timeline
Published7 Feb 2012
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2012-0992 · NVD
Track software like this
Free during beta