Threats tagged 'ghsa-wqrg-546p-pxg4'

OpenEMR versions prior to 8.5.0 contain an SQL injection vulnerability in the ippf_statistics.php report interface. Authenticated users with report access can manipulate the form_facility parameter to inject SQL code, potentially reading sensitive database information. The vulnerability allows attackers to close string literals in the facility_id WHERE clause and use boolean or time-based payloads. The CVSS score is 6.5, indicating a medium severity impact with high confidentiality impact but no integrity or availability impact.