Threats tagged 'ghsa-h4mx-8cw8-cfv2'

OpenEMR versions prior to 8.4.0 have a mass assignment vulnerability in the patient portal's OnsiteDocument query API. This flaw allows authenticated patient portal users to inject SQL via certain parameters, such as Id_BitwiseAnd, which are used unquoted in SQL WHERE clauses. Exploitation can lead to unauthorized reading of any database table, including other patients' records and staff password hashes.