Threats tagged 'ghsa-wq2w-mvp4-xrqr'

OpenEMR versions prior to 8.3.0 have an insecure direct object reference (IDOR) vulnerability in the OnsiteDocumentController::Query() function. This flaw allows authenticated portal patients to access other patients' documents by manipulating request parameters such as Pid_Equals, Pid_GreaterThan, or Pid_In. Exploitation can lead to unauthorized disclosure of sensitive patient information including signed consent forms, signatures, and protected health information (PHI).