Description
OpenEMR before 8.5.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users with patients/med access to exhaust PHP workers via an unbounded count parameter. Attackers can send print_labels requests to labs_ajax.php with huge counts, forcing mPDF page and barcode generation that makes OpenEMR unavailable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Open-Emr | OpenEMR | 0 <8.5.0 | — |