Threats tagged 'ghsa-xh45-xw7v-4c5r'

OpenEMR versions prior to 8.5.0 contain an SQL injection vulnerability in the SLEOB::slInvoiceNumber() function within src/Billing/SLEOB.php. This vulnerability arises because the CLP01 claim identifier from uploaded X12 835 ERA files is concatenated directly into an SQL query without proper escaping or parameter binding. Authenticated users with billing permissions or malicious payers whose ERA files are uploaded by clerks can exploit this flaw to execute arbitrary SQL commands, potentially reading sensitive data such as password hashes and modifying database contents.