National Cyber Awareness System

Vulnerability Summary for CVE-2007-0649

Overview

Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier allows remote attackers to overwrite arbitrary program variables and conduct other unauthorized activities, such as conduct (a) remote file inclusion attacks via the srcdir parameter in custom/import_xml.php or (b) cross-site scripting (XSS) attacks via the rootdir parameter in interface/login/login_frame.php, via vectors associated with extract operations on the (1) POST and (2) GET superglobal arrays. NOTE: this issue was originally disputed before the extract behavior was identified in post-disclosure analysis. Also, the original report identified "Open Conference Systems," but this was an error.

Description

Incorrect bug report. This CVE should have a score of 0 because there are no products affected.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 22348

Hyperlink:http://www.securityfocus.com/bid/22348

External Source: BID

Name: 22346

Hyperlink:http://www.securityfocus.com/bid/22346

External Source: BUGTRAQ

Name: 20070130 Re: Fake: Open Conference Systems = 2.8.2 Remote File Inclusion

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/458565/100/0/threaded

External Source: BUGTRAQ

Name: 20070128 Re: Open Conference Systems = 2.8.2 Remote File Inclusion

Type: Advisory

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/458486/100/0/threaded

External Source: BUGTRAQ

Name: 20070129 Re: Fake: Open Conference Systems = 2.8.2 Remote File Inclusion

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/458476/100/0/threaded

External Source: BUGTRAQ

Name: 20070129 Fake: Open Conference Systems = 2.8.2 Remote File Inclusion

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/458456/100/0/threaded

External Source: BUGTRAQ

Name: 20070127 Re: Open Conference Systems = 2.8.2 Remote File Inclusion

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/458426/100/0/threaded

External Source: BUGTRAQ

Name: 20070127 Open Conference Systems = 2.8.2 Remote File Inclusion

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/458306/100/0/threaded

External Source: SREASON

Name: 2202

Hyperlink:http://securityreason.com/securityalert/2202

External Source: OSVDB

Name: 33609

Hyperlink:http://osvdb.org/33609

External Source: OSVDB

Name: 33603

Hyperlink:http://osvdb.org/33603

External Source: VIM

Name: 20070131 VERIFY of RFI and XSS in OpenEMR 2.8.2 (was [still bogus] V [mike at carstein.kill-9.pl: Re: Open Conference Systems = 2.8.2 Remote File Inclusion])

Type: Advisory

Hyperlink:http://attrition.org/pipermail/vim/2007-January/001258.html

External Source: VIM

Name: 20070129 [still bogus] V [mike at carstein.kill-9.pl: Re: Open Conference Systems = 2.8.2 Remote File Inclusion] (fwd)

Type: Advisory

Hyperlink:http://attrition.org/pipermail/vim/2007-January/001254.html