CVE-2020-36243: OpenEMR Patient Portal backup.php OS Command Injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityHigh CVSS (8.8) and very high EPSS with public exploit detail, though exploitation requires an authenticated account.

What it is

OpenEMR 5.0.2.1 contains an OS command injection flaw in /interface/main/backup.php. An authenticated attacker can send a POST request with shell metacharacters to execute arbitrary operating system commands. Because OpenEMR handles patient records, command execution on the server puts sensitive health data and the host at risk.

Impact

An attacker with a valid account gains arbitrary OS command execution on the OpenEMR server, enabling data theft, tampering, or full host compromise.

Attack surface

Reachable over the network via HTTP POST to /interface/main/backup.php; the CVSS vector shows PR:L, so a low-privileged authenticated account is required and no user interaction is needed.

Exploitation

Not listed in CISA KEV, but EPSS is 0.64144 (99.19th percentile) and references include an Exploit-tagged third-party advisory, indicating public exploit detail exists.

What to do

• Apply the OpenEMR 5.0.2 Patch 5 or later vendor patch immediately.
• Restrict access to /interface/main/backup.php to trusted administrative networks or roles.
• Remove or disable unused backup functionality and enforce least privilege on OpenEMR accounts.
• Audit and rotate credentials for any account that could reach the affected endpoint.
• Monitor the server for unexpected child processes spawned by the web server user.

Detection

• Inspect HTTP POST bodies to /interface/main/backup.php for shell metacharacters such as ;, |, &&, $(), or backticks.
• Alert on web server or PHP-FPM processes spawning shells or system utilities like sh, bash, curl, or wget.
• Review OpenEMR authentication logs for unusual access to backup.php by low-privileged users.
• Hunt for outbound connections or file writes originating from the OpenEMR web process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.