Vulnerability

Philips Tasy EMR HTML5 has two SQL injection flaws that expose patient data

MedDevice Cyber Staff · Nov 4 · 2 min read · Via CISA ICSMA-21-308-01

CISA published advisory ICSMA-21-308-01 on November 4, 2021, for Philips Tasy EMR HTML5, Version 3.06.1803 and prior. An anonymous party reported the flaws.

Both are SQL injection (CWE-89) with CVSS v3 scores of 8.8. CVE-2021-39375 is reachable through the FilterValue parameter of WAdvancedFilter/getDimensionItemsByCode. CVE-2021-39376 sits in the IE_CORPO_ASSIST or CD_USUARIO_CONVENIO parameter of CorCad_F2/executaConsultaEspecifico. An attacker needs a low-privilege account and nothing else.

Any authenticated user can turn those parameters into arbitrary queries against the Tasy database. CISA says exploitation could expose or extract patients' confidential data, give unauthorized access or cause a denial of service.

Philips recommends updating to Tasy EMR HTML5 Version 3.06.1804 or later with the latest service pack, where both CVEs are remediated. Parameterize every query, including the ones behind internal filter screens.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update Philips Tasy EMR HTML5 to Version 3.06.1804 or later with the latest service pack; it remediates CVE-2021-39375 and CVE-2021-39376. Both flaws need only a low-privilege account, so review account hygiene and database query logs for unusual activity from regular users.

Update to 3.06.1804 or later. Install the release with the latest service pack where both CVEs are fixed.
Review low-privilege accounts. Disable stale Tasy accounts, since any authenticated user can reach the injectable parameters.
Bind query parameters. Use parameterized queries for every user-supplied filter value.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Patient or study database

Contributing

Handles patient data User accounts Web interface

Tasy EMR HTML5

Patient or study database Handles patient data User accounts

Fix the class in your product

Input reaches the database as query text. As the maker, parameterize every query so input is never concatenated into SQL, run on a least-privilege database account, and enforce it with a static-analysis gate so a concatenated query fails the build.

Parameterize every query. No exceptions for internal or trusted callers; bind inputs, never build statement text from them.
Least-privilege the database role. The app account cannot alter schema or reach unrelated tables.
Gate it in CI/CD. Static analysis fails a build that concatenates a query.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Assert-IQ (DM5000)	Abbott	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Dose IQ Safety Software	Baxter	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer
WAVE Clinical Platform	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
BD Alaris Infusion System with Guardrails Suite MX	BD	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer
BD Phoenix Automated Microbiology System	BD	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer
Image Suite	Carestream Health	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Dexcom Smart Basal	DexCom	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Infinity CentralStation Wide	Dräger	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer
aPROMISE	Exini Diagnostics	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Universal Viewer	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer
Heartvue.Proton	HeartVue	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
da Vinci SP Surgical System	Intuitive	Same property (MITRE EMB3D)PID-332	No feedback feed from manufacturer

14 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2021-39375 in Philips Tasy EMR?

CVE-2021-39375 is a SQL injection flaw (CWE-89, CVSS v3 8.8) in Philips Tasy EMR HTML5 3.06.1803 and prior, reachable through the FilterValue parameter of WAdvancedFilter/getDimensionItemsByCode. CISA advisory ICSMA-21-308-01, published November 4, 2021, covers it alongside CVE-2021-39376.

How do I fix the Philips Tasy EMR SQL injection vulnerabilities?

Update Philips Tasy EMR HTML5 to Version 3.06.1804 or later with the latest available service pack, which remediates CVE-2021-39375 and CVE-2021-39376, per CISA advisory ICSMA-21-308-01.

← Back to Vulnerabilities