Threats tagged 'ghsa-93j6-9h8j-mxgh'

OpenEMR versions prior to 8.4.0 have a local file inclusion vulnerability in the ESign router component. This flaw allows authenticated attackers to upload a PHP file named Controller.php via the fax module's upload functionality, which does not validate file extensions. The attacker can then exploit the unsanitized module parameter in the ESign router to include and execute this uploaded file, leading to arbitrary code execution.