Threats tagged 'ghsa-5cpf-94g3-rh5p'

OpenEMR versions prior to 8.3.0 have a missing authorization vulnerability in the classic document controller. This flaw allows low-privilege authenticated users to recategorize documents belonging to other patients. By exploiting the move_action_process function, attackers can move documents into a patients|demo category and then retrieve them without specifying a patient ID, enabling exfiltration of protected health information (PHI) and unauthorized modification of patient charts.