Authenticated Unrestricted File Write in letter.php #1213
Labels
Web Security
White Hat Reports, Cross Site SQL Injection, etc
Comments
|
I will like to be assigned this issue |
|
Please go ahead
On Mon, 16 Mar 2020 at 14:14 Jema ***@***.***> wrote:
I will like to be assigned this issue
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#1213 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AD4X4XSGBG5VK5RTFSQXMLDRHYQ2TANCNFSM4FLLOEDQ>
.
--
*MUA N. LAURENT*: Lead Software Engineer
Akivas Inc. <https://akivas.com/>
Akwa, Douala,CM 00237 | 174 Royal Rd, Cape Town, WC 7405, SA
Phone: (237) 670-518-086
|
realJema
added a commit
to realJema/lh-ehr
that referenced
this issue
Mar 17, 2020
Closed
realJema
added a commit
to realJema/lh-ehr
that referenced
this issue
Mar 17, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The Issue
Unrestricted file write vulnerabilities allow attackers to write file such as PHP files, in locations where the web server user has access to write. This may allow an attacker to write files with malicious content and may lead to remote code execution.
An attacker must be authenticated to perform this attack.
Where the Issue Occurred
The following code snippet displays the usage of the
fopenfunction in PHP within the lh-ehr application:lh-ehr/interface/patient_file/letter.php
Line 254 in cacaa71
This creates or overwrites a file that the web server user has access to. The following code snippet displays writing user controlled content within the user controlled file:
lh-ehr/interface/patient_file/letter.php
Line 260 in cacaa71
The text was updated successfully, but these errors were encountered: