CVE-2011-5161

CVE-2011-5161 describes an unrestricted file upload vulnerability in OpenEMR 4's patient photograph functionality. This flaw allows unauthenticated remote attackers to execute arbitrary PHP code by uploading a malicious file with a double extension (e.g., .php.jpg) and then directly accessing it within the patient documents directory. With a CVSS score of 6.8, this vulnerability is of medium severity, requiring moderate attack complexity but potentially leading to partial compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.