Threats tagged 'ghsa-xx67-hf9j-67wx'

OpenEMR versions prior to 8.3.0 have an SQL injection vulnerability in the Standard REST API endpoints for patient insurance and employer search. This flaw allows authenticated users, including those with low-privilege patient-portal OAuth2 tokens, to craft parameter names that are concatenated into SQL queries without proper escaping. Exploitation can lead to unauthorized extraction of patient protected health information (PHI), user records, and API client secrets.