Open-emr Vulnerabilities

This vulnerability allows an attacker to send any file from the server, including sensitive information like database credentials and patient documents, to a phone number they control. It can be exploited by any authenticated user of the system, as the application does not properly restrict which files can be accessed or sent.

This vulnerability allows an attacker to bypass authorization controls and gain access to restricted areas of the OpenEMR application. To exploit this, the attacker needs to manipulate a user-controlled key, which could happen if they have access to the application or its configuration.