Threats tagged 'ghsa-4x43-68v3-4x7c'

OpenEMR versions prior to 8.5.0 contain an authenticated SQL injection vulnerability in the Syndromic Surveillance module. This flaw allows users with Clinician-level privileges to manipulate database contents by submitting crafted input to a specific POST parameter. Exploitation can lead to extraction of bcrypt password hashes and execution of stacked queries that reset passwords, enabling full administrative account takeover.