CVE-2022-29938

Name of the Vulnerable Software and Affected Versions LibreHealth EHR version 2.0.0

Description The issue is related to a lack of sanitization of the payment id parameter in the interfacebilling ew payment.php file via interfacebillingpayment master.inc.php, which leads to SQL injection.

Recommendations For LibreHealth EHR version 2.0.0, consider disabling access to the interfacebilling ew payment.php file until a patch is available to prevent SQL injection via the payment id parameter. Restrict access to the interfacebillingpayment master.inc.php file to minimize the risk of exploitation. Avoid using the payment id parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.