PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Solismed Version 3.3SP1

bishopfox.com | blog | #rce | #advisory | #healthcare | #file-upload | #solismed | #emr | #cve-2019-15936
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Advisory on multiple flaws in Solismed 3.3SP1's EMR — insecure file upload (RCE), LFI, XSS, CSRF, broken access controls and more — enabling full server compromise; fixed in 3.5.
Published
Collected

Related coverage

blog · netspi.com
Mayo Clinic's Solution for Social Media Challenges
Mayo Clinic launched a Center for Social Media to train practitioners on responsible use, addressing PHI risks as EMR sharing expands. The author favors its guidance over blanket blocking.
blog · netspi.com
EMR Security in the Cloud
A NetSPI analysis of HHS breach data argues there is not enough evidence to judge whether moving EMR records to the cloud raises HIPAA risk, noting Business Associates account for ~20% of incidents.
blog · bishopfox.com
TaskCafe, Version 0.3.2 Advisory
Bishop Fox discloses three TaskCafe 0.3.2 vulnerabilities—improper access controls, stored XSS, and insecure file uploads—that chain to take over administrator accounts.
blog · bishopfox.com
OpenClinic Version 0.8.2 Advisory
Four flaws in OpenClinic 0.8.2: unauthenticated access to patient test results (CVE-2020-28937), RCE via insecure file upload, XSS privilege escalation, and path traversal; no fixed release exists.
blog · hackerone.com
Handling Large File Uploads in React: Securely Using AWS S3 Pre-signed URLs
S3 pre-signed URLs let React apps upload multi-gigabyte files without exposing AWS credentials. The article covers short-lived URLs, CORS settings, client validation, logging, and multipart uploads.
blog · yeswehack.com
File Upload Attacks (Part 2)
Part two of the file upload series: pixel flood DoS, XSS and CSV injection via uploads, open redirect, SSRF and XXE, plus bypass techniques, tooling and remediation advice.
Back