{"uuid": "2e3ba5d9-07ad-44f9-b875-644ed009ef34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40352", "type": "seen", "source": "https://t.me/hacking_Attack/22272", "content": "Exploit Collector\nOpenEMR 6.0.0 Insecure Direct Object Reference\n\nhttps://4.bp.blogspot.com/-gQsa2Au6OFw/WWlvKe9cGFI/AAAAAAAAIME/7MuhuX3Jqy0CeEu0oyVXmXST8BDpKvIGgCLcBGAs/s1600/h15.png \nOpenEMR version 6.0.0 suffers from an insecure direct object reference vulnerability.\n\nMD5 | cfdad061a5f147865a0eb5338656760f\n\nDownload\n# Exploit Title: Openemr 6.0.0 - Insecure direct object references \n# Date: 31/8/2021 \n# Exploit Author: Allen Enosh Upputori \n# Vendor Homepage: https://community.open-emr.org \n# Version: 6.0.0 \n# Tested on: Linux \n# CVE: 2021-40352 \n\nPoC: An attacker who has Physician Access can read messages with were sent to others members including admin messages the vulnerability exits in the print message feature = \"pnotes_print.php?noteid=16\" changing the \"noteid=\" to any other number will reveal the messages of everyone \n\nhttps://github.com/allenenosh/CVE-2021-40352 \n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:25.777997Z"}