CVE-2012-0991

Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the formname parameter to (1) contrib/acog/print_form.php; or (2) load_form.php, (3) view_form.php, or (4) trend_form.php in interface/patient_file/encounter.

CVSS v2.0 NVD

3.5 LOWAV:N/AC:M/Au:S/C:P/I:N/A:N

EPSS

9.19% chance of exploitation in the next 30 days, 95th percentile

Nuclei

low · CWE-22

Published

2012-02-07

Updated

2024-08-06

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2012/CVE-2012-0991.yaml

ExploitDB entries (3)

• https://www.exploit-db.com/exploits/36650
• https://www.exploit-db.com/exploits/36649
• https://www.exploit-db.com/exploits/36648

Security advisories

• http://secunia.com/advisories/47781
• http://archives.neohapsis.com/archives/bugtraq/2012-02/0004.html
• http://www.open-emr.org/wiki/index.php/OpenEMR_Patches
• https://www.htbridge.ch/advisory/HTB23069
• http://www.securityfocus.com/bid/51788

References

• CVE Record
• NVD entry