Threats tagged 'ghsa-59mr-wpc5-mhfg'

OpenEMR versions prior to 8.3.0 have a broken access control vulnerability in portal/portal_payment.php. This flaw allows authenticated users with low privileges to bypass billing access control checks by manipulating patient identifier parameters. Exploitation enables viewing payment pages and recording fraudulent payment receipts for arbitrary patients, leading to corrupted billing records.