Product
OpenEMR versions prior to 8.5.0 contain an authenticated SQL injection vulnerability in the Syndromic Surveillance module, enabling Clinician-level users to perform error-based data exfiltration and administrative account takeover.