Threats tagged 'ghsa-pfrx-3wpm-pv74'

OpenEMR versions prior to 8.5.0 have a stored SQL injection vulnerability in the getByPatientDemographics() function. This flaw arises because layout_options field_id values are concatenated directly into the patient search WHERE clause. An attacker with Layout Editor privileges can insert a malicious field_id, enabling any authenticated low-privilege user to exfiltrate sensitive data from patient_data and users_secure tables.