CVE-2018-15153: OpenEMR daemon_frame.php OS command injection via hylafax_server

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote authenticated command execution in an EHR platform with a public exploit and very high EPSS score, though it requires prior authenticated access.

What it is

OpenEMR before 5.0.1.4 contains an OS command injection flaw in interface/main/daemon_frame.php. An authenticated attacker can set the hylafax_server global variable through interface/super/edit_globals.php and then trigger command execution with a crafted request. Because OpenEMR is a clinical records system, command execution on the server exposes patient data and the hosting infrastructure.

Impact

The attacker gains arbitrary command execution with the privileges of the web server process, enabling data theft, tampering with the EHR, or further lateral movement.

Attack surface

Reachable over the network through the web interface; the CVSS vector indicates low privileges are required and no user interaction. The attacker must first modify the hylafax_server global via edit_globals.php, which implies access to an administrative or global-settings function.

Exploitation

Not listed in CISA KEV, but EPSS is 0.61555 (99.1st percentile) and a public Exploit-DB entry (45161) exists, so exploitation is practical and likely.

What to do

• Upgrade OpenEMR to 5.0.1.4 or later, applying the vendor patch noted in the OpenEMR patches wiki.
• Restrict access to interface/super/edit_globals.php to trusted administrators only.
• Validate and sanitize the hylafax_server global before it is used in any shell command.
• Run the web server with least privilege and block outbound command execution paths where feasible.

Detection

• Monitor web logs for requests to interface/main/daemon_frame.php and interface/super/edit_globals.php, especially unusual hylafax_server values.
• Alert on child processes spawned by the web server (PHP/Apache/nginx) that invoke shell commands.
• Audit changes to global settings in OpenEMR for unexpected hylafax_server modifications.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.