Threats tagged 'ghsa-7qpc-7f6v-27vh'

OpenEMR versions prior to 8.3.0 have a path traversal vulnerability in the file interface/billing/sl_eob_process.php. This flaw allows authenticated users to write and read files by providing unsanitized 'eraname' values. Attackers without billing privileges can exploit this by injecting '../' sequences to create ERA report .html files in arbitrary writable locations and parse arbitrary .edi files within the report.