Threats affecting pkg:github/openemr

OpenEMR versions prior to 8.5.0 contain an authenticated SQL injection vulnerability in the Syndromic Surveillance module. This flaw allows users with Clinician-level privileges to manipulate database contents by submitting crafted input to a specific POST parameter. Exploitation can lead to reading sensitive data such as bcrypt password hashes and executing queries that reset passwords, enabling full administrative account takeover. The vulnerability is fixed in version 8.5.0.