PT-2019-14661

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.3 Description The issue allows a user to extract arbitrary data from the database via a non-parameterized INSERT INTO statement. This can be achieved by exploiting the providerID parameter in the interface/forms/e...