Threats tagged 'ghsa-v2w6-cjv6-3m3w'

OpenEMR versions prior to 8.3.0 contain a critical SQL injection vulnerability in the Fee Sheet drug-inventory lookup functionality. This flaw allows low-privileged authenticated users to inject SQL code via the prod[N][warehouse] POST parameter, enabling time-based blind SQL injection attacks. Exploitation can lead to unauthorized extraction of sensitive patient data and bcrypt password hashes from the users_secure table.