Threats tagged 'ghsa-vj64-2xj8-pcw7'

OpenEMR versions prior to 8.5.0 have a second-order SQL injection vulnerability in the IPPF contraceptive issue feature. This occurs because the issue_ippf_con_save function concatenates user-controlled field_id values into a SQL REPLACE INTO query as column names. Authenticated administrators can exploit this by adding a malicious field_id via edit_layout.php and then triggering the vulnerable function through add_edit_issue.php, allowing arbitrary SQL execution.