CVE-2007-0649 - CVE House

Back to Database

Status published Medium CVE-2007-0649

Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier...

4.3 CVSS

Vulnerability Description

Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier allows remote attackers to overwrite arbitrary program variables and conduct other unauthorized activities, such as conduct (a) remote file inclusion attacks via the srcdir parameter in custom/import_xml.php or (b) cross-site scripting (XSS) attacks via the rootdir parameter in interface/login/login_frame.php, via vectors associated with extract operations on the (1) POST and (2) GET superglobal arrays. NOTE: this issue was originally disputed before the extract behavior was identified in post-disclosure analysis. Also, the original report identified "Open Conference Systems," but this was an error.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-0649

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from openemr

View All →

OpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege Escalation

OpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal

OpenEMR Has Disabled SSL Certificate Verification in HTTP Client

OpenEMR Vulnerable to Broken Access Control in Profile Edit Endpoint

OpenEMR has Stored XSS in ub04 helper

Affected Vendor

openemr

View all reports →

Affected Software

openemr

Vulnerable Versions:

0

Timeline

Official Publish: February 1st, 2007

Last Modified: August 7th, 2024

Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.