Manfromkz

**Name of the Vulnerable Software and Affected Versions** LibreHealth EHR version 2.0.0 **Description** The issue is related to a lack of sanitization of the `payment id` parameter in the interfacebilling ew payment.php file via interfacebillingpayment master.inc.php, which leads to SQL injection. **Recommendations** For LibreHealth EHR version 2.0.0, consider disabling access to the interfacebilling ew payment.php file until a patch is available to prevent SQL injection via the `payment id` parameter. Restrict access to the interfacebillingpayment master.inc.php file to minimize the risk of exploitation. Avoid using the `payment id` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LibreHealth EHR version 2.0.0 **Description** The issue is related to a lack of sanitization of the GET parameters `formseq` and `formid` in the "interface/orders/find order popup.php" endpoint, leading to multiple cross-site scripting (XSS) vulnerabilities. **Recommendations** For LibreHealth EHR version 2.0.0, consider disabling access to the "interface/orders/find order popup.php" endpoint until a patch is available, or ensure proper sanitization of the `formseq` and `formid` parameters to prevent XSS attacks.

**Name of the Vulnerable Software and Affected Versions** LibreHealth EHR version 2.0.0 **Description** The issue arises from the lack of sanitization of the GET parameters `debug` and `InsId` in the interfacebillingsl eob process.php file, leading to multiple cross-site scripting (XSS) vulnerabilities. **Recommendations** For LibreHealth EHR version 2.0.0, consider disabling access to the interfacebillingsl eob process.php file until a patch is available, or restrict the use of the `debug` and `InsId` parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Chamilo versions prior to 1.11.14 **Description** The issue is related to a lack of protection in the SQL query structure, which can be exploited to impact the confidentiality, integrity, and availability of protected information. The `searchField`, `filters`, or `filters2` parameter in the `main/inc/ajax/model.ajax.php` file is vulnerable to SQL Injection. **Recommendations** For versions prior to 1.11.14, as a temporary workaround, consider restricting access to the `main/inc/ajax/model.ajax.php` file or disabling the `searchField`, `filters`, or `filters2` parameter until a patch is available. Avoid using the `searchField`, `filters`, or `filters2` parameter in the affected API endpoint until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 5.0.2.5 Description: A SQL injection issue allows a remote authenticated attacker to execute arbitrary SQL commands. The issue is related to the `searchFields` parameter in the interface/main/finder/patient select.php file, which is part of the library/patient.inc library. Recommendations: For versions prior to 5.0.2.5, update to version 5.0.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the `patient select.php` file or avoiding the use of the `searchFields` parameter until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 5.0.2.5 Description: A SQL injection issue allows a remote authenticated attacker to execute arbitrary SQL commands. The issue is related to the `form code` parameter in the interface/reports/non reported.php file. Recommendations: For versions prior to 5.0.2.5, update to version 5.0.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the interface/reports/non reported.php file to minimize the risk of exploitation. Avoid using the `form code` parameter in the affected file until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 5.0.2.5 Description: A SQL injection issue allows a remote authenticated attacker to execute arbitrary SQL commands via the `schedule facility` parameter when `restrict user facility=on` is in global settings. This occurs in the interface/usergroup/usergroup admin.php file. Recommendations: For versions prior to 5.0.2.5, update to version 5.0.2.5 or later to resolve the issue. As a temporary workaround, consider disabling the `schedule facility` parameter in the usergroup admin.php file when `restrict user facility=on` is set in global settings, or restrict access to the interface/usergroup/usergroup admin.php file to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 5.0.2.5 Description: A SQL injection issue allows a remote authenticated attacker to execute arbitrary SQL commands. The issue is related to the `form code` parameter in the interface/reports/immunization report.php file. Recommendations: For versions prior to 5.0.2.5, update to version 5.0.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the interface/reports/immunization report.php file to minimize the risk of exploitation. Avoid using the `form code` parameter in the affected file until the issue is resolved.