SQL Injection in OpenEMR eye_mag make_task function

This repository contains a Python 2 exploit script (exploit.py) and a README.md documenting the exploitation of CVE-2018-17179 in OpenEMR 5.0.1. The exploit targets a flaw in the authentication and configuration management of OpenEMR, allowing an authenticated attacker to inject arbitrary commands into the application's global configuration via the /interface/super/edit_globals.php endpoint. The script first authenticates to the application using provided credentials, then crafts a POST request with a payload that includes a base64-encoded command. This command is executed when the attacker accesses the /interface/main/daemon_frame.php endpoint, resulting in remote code execution as the web server user. The exploit is operational and can be used to obtain a reverse shell or execute arbitrary commands. The repository is well-documented, with clear usage instructions and references to the original vulnerability and exploit sources. No hardcoded IPs or domains are present, but the script interacts with specific OpenEMR endpoints that are fingerprintable. The exploit requires valid credentials and is not a detection script, but a working exploit for authenticated RCE.

This repository contains a single Metasploit auxiliary module targeting a SQL injection vulnerability (CVE-2018-17179) in OpenEMR version 5.0.1 Patch 6 and lower. The module, written in Ruby, leverages the Metasploit framework's HTTP and SQLi libraries to automate the exploitation process. It works by sending crafted GET requests to the vulnerable 'taskman.php' endpoint, using the 'enc' parameter to inject SQL via the updatexml() function. The exploit first checks the OpenEMR version by querying 'admin.php', then attempts to enumerate and dump all database tables (excluding certain large or volatile tables) as CSV files, which are saved in the attacker's loot directory. The module is operational and provides full database extraction capabilities, making it a powerful tool for post-exploitation or data theft scenarios. The only file in the repository is the Metasploit module itself, and it is self-contained.