Threats tagged 'ghsa-pj78-c8jq-8xhf'

OpenEMR versions through 8.2.0 contain a critical remote code execution vulnerability in the document category tree component. Authenticated administrators can inject PHP payloads into the categories database table by exploiting a flaw that allows altering the id column type to VARCHAR and inserting malicious code. This payload is executed via an unsanitized eval() call whenever the CategoryTree class is instantiated, including on pages accessible to unauthenticated or low-privilege users, resulting in command execution as the web server user.