CVE-2018-17179

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 12.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-05-17 · updated 2026-06-17
Weakness: CWE-89

Description

An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the make_task function in /interface/forms/eye_mag/php/taskman_functions.php via /interface/forms/eye_mag/taskman.php.

Affected products

openemr: before 5.0.1.7 — fixed in 5.0.1.7

How to fix

Upgrade to a fixed version: openemr 5.0.1.7. Check the vendor advisory for mitigations.

References

https://github.com/openemr/openemr/commit/3e22d11c7175c1ebbf3d862545ce6fee18f70617
https://www.open-emr.org/wiki/index.php/OpenEMR_Patches#5.0.1_Patch_.289.2F9.2F18.29
https://github.com/openemr/openemr/commit/3e22d11c7175c1ebbf3d862545ce6fee18f70617
https://www.open-emr.org/wiki/index.php/OpenEMR_Patches#5.0.1_Patch_.289.2F9.2F18.29

Get alerted when CVE-2018-17179 or the next vulnerability affects your stack