Threats tagged 'ghsa-8hgw-jvfm-jc87'

OpenEMR versions prior to 8.5.0 contain active debug code in the interface/fax/fax_view.php file that executes the passthru("groups") command. This causes disclosure of the web server's Unix group memberships. Authenticated users with access to the fax module can exploit this by supplying a nonexistent jid value to reveal sensitive group information such as adm or shadow, which could assist in planning privilege escalation attacks.