Insecure Direct Object Reference Vulnerability in OpenEMR by OpenEMR
CVE-2021-40352
6.5MEDIUM
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2021-40352?
OpenEMR version 6.0.0 is susceptible to an Insecure Direct Object Reference vulnerability that allows an attacker to access and read the private messages of any user through the pnotes_print.php endpoint. This flaw exploits the improper validation of user input, posing a serious security risk, as unauthorized individuals could gain insights into sensitive communications within the system. It is crucial for users of this version to implement recommended security measures and updates to mitigate potential damage.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.