OpenEMR vulnerabilities

In OpenEMR before 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLER_ACL_MAP, and checkControllerAcl() returns without enforcing any permission for those entries. A low-privilege authenticated user can invoke C_X12Partner::edit_action_process() to create or alter insurance-routing hosts and credentials, or invoke C_PatientFinder::find_action_process() to enumerate patient names, dates of birth, and identifiers. The shared fail-open dispatcher root cause also exposes other administrative controllers.

In OpenEMR before 8.3.0, library/ajax/set_pt.php lets any authenticated user set an arbitrary patient identifier in the session without an ACL check, and download_template.php trusts that value. A low-privilege user can download a rendered document template containing another patient's demographics, encounters, allergies, medications, and problem list.

In OpenEMR before 8.3.0, custom/ajax_download.php, custom/download_qrda.php, custom/export_qrda_xml.php, and custom/qrda_download.php validate CSRF but do not enforce the patients/med ACL. They also accept an unscoped report_id, allowing a low-privilege user to download QRDA Category One and Three documents for patients in a measure.

In OpenEMR before 8.3.0, the sms_search branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot access patient data through the normal interface can search the MedEx SMS endpoint and receive patient identifiers, names, phone numbers, SMS permission status, and recent message information.

In OpenEMR before 8.3.0, the new_recall branch of interface/main/messages/save.php accepts a caller-supplied pid without enforcing patient-level or recall-workflow authorization. A low-privilege authenticated user who knows or enumerates a patient identifier can retrieve patient details, contact fields, HIPAA notification preferences, recent appointment information, and existing recall information.

In OpenEMR before 8.3.0, library/ajax/payment_ajax.php validates a CSRF token but performs no AclMain authorization check before searching patient_data. Any authenticated user, including non-clinical roles, can enumerate patient identifiers, full names, and dates of birth.

In OpenEMR before 8.3.0, the search_persons action in library/ajax/person_search_ajax.php validates CSRF but does not perform an AclMain authorization check before searching the person and patient_data tables. A low-privilege user can iterate name prefixes and receive patient names, dates of birth, gender, phone numbers, and email addresses.

In OpenEMR before 8.3.0, interface/modules/custom_modules/oe-module-dorn/public/compendium_install.php checks authentication and CSRF but does not require the admin/users ACL enforced by sibling DORN administration scripts. When the DORN module is enabled, a low-privilege authenticated user can supply a labGuid that causes LabCompendiumInstall::uninstall() to delete detail and result procedure types and deactivate order types before the reinstall step.

In OpenEMR before 8.3.0, the Weno module's file_download.php lacks ACL and CSRF checks and ignores the result of validateAdminCredentials(). With the Weno module enabled, the default GET path calls PharmacyService::removeWenoPharmacies() before refetching, allowing any authenticated user to truncate the weno_pharmacy table and allowing a cross-site request to trigger the same operation via a logged-in victim.

In OpenEMR before 8.3.0, interface/patient_file/pos_checkout_ippf.php performs state-changing void, voidall, and regen operations through GET requests without CSRF token validation. The form_checksum integrity check is conditional and is skipped when the parameter is omitted, allowing a cross-site request to force an authenticated billing user to void checkouts or regenerate invoice counters.

In OpenEMR before 8.3.0, interface/forms/transfer_summary/new.php and interface/forms/functional_cognitive_status/new.php render stored transfer_to, code, and codetext values with text(), which uses ENT_NOQUOTES, inside double-quoted HTML value attributes. An authenticated clinical user can store a value containing a double quote that escapes the attribute and injects event-handler markup when another clinician opens the form.

In OpenEMR from 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate temp_authuserid and load that account's user_settings before authentication succeeds. Timing or page differences allow a remote unauthenticated actor to enumerate valid accounts for later credential attacks.

In OpenEMR before 8.3.0, the webroot admin.php multisite administration page is enabled without an authentication check, reads database configuration from sqlconf.php, and connects to each configured site database. An unauthenticated network actor can obtain site identifiers, database names, site names, exact OpenEMR versions and patch levels, pending upgrade status, and direct login and patient-portal links.

In OpenEMR before 8.3.0, userSessionLogout() in src/RestControllers/AuthorizationController.php uses decodeToken() to process an id_token_hint without verifying its signature and, when the referenced trusted session is absent, redirects to the caller-supplied post_logout_redirect_uri before validating it against the client's registered redirect URIs. An unauthenticated attacker can craft a logout link that sends a user to an arbitrary external site and invalidates the user's session.

OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module. A user with Clinician-level privileges can read and modify arbitrary database contents via crafted values in the form_icd_codes[] POST parameter at the syndromicsurveillance/index endpoint, enabling exfiltration of bcrypt password hashes and administrative account takeover.

OpenEMR before version 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestore_sel parameter is passed without sanitization, and differing response messages leak whether the target path exists. An authenticated user with EOB Data Entry permissions can probe arbitrary filesystem paths.

OpenEMR before 8.3.0 contains a cross-site request forgery vulnerability in the DICOM viewer. The web_path GET parameter is embedded as a URL without validation against expected path formats. An attacker can craft a URL that causes an authenticated user with Patients - Documents permissions to make authenticated requests to arbitrary OpenEMR endpoints, enabling forced logout and other state-changing actions.

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler. Authenticated attackers with Forms Administration permissions can upload template files containing arbitrary HTML or JavaScript. Malicious scripts are stored without sanitization and execute in the browser of any other Forms Administration user who views the template in the HTML editor.

OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a URL that executes arbitrary JavaScript in the browser of any authenticated user with Forms Administration permissions who visits the link, enabling session hijacking.

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard_tables_manage.php interface where the db GET parameter is passed without validation to temp_dir_cleanup(), which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers can supply a traversal sequence in the db parameter to resolve outside the intended temporary directory, and by chaining this with an open redirect in dicom_frame.php, an unauthenticated attacker can deliver a crafted URL that triggers arbitrary recursive directory deletion within an authenticated Superuser's session.

OpenEMR through 8.2.0 contains a stored XSS vulnerability in the patient portal template system. Authenticated administrators can inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags. Lack of output encoding at the template retrieval endpoint and missing HttpOnly cookie attributes allow session token exfiltration via document.cookie.

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAuth2 client and use the password grant to obtain an API access token, bypassing normal web interface authentication and any enforced multi-factor authentication controls.

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an administrator approves the registered client, attackers can use the client_credentials grant with a self-signed JWT assertion to obtain access tokens granting read access to all FHIR resources across all patients in the system.

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the form_step=202 parameter in backup.php. Attackers can exploit the unfiltered shell_exec invocation of the mysql command-line client to extract credential hashes, modify access control tables, inject backdoor accounts, create persistent triggers or stored procedures, and write arbitrary files to the filesystem where MySQL FILE privileges and permissive secure_file_priv settings are configured.

OpenEMR before version 8.0.0.1 contains a stored XSS vulnerability in the prescription CSS/HTML multi-print feature. A patient portal user can inject malicious JavaScript into demographic fields, which executes in the clinician's session, allowing session hijacking and actions as the clinician.

OpenEMR version 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections. Attackers can send repeated login attempts to the main login endpoint, systematically testing username and password combinations.

OpenEMR is a free and open source electronic health records application. Prior to version 8.0.0, the document controller's patient_picture context serves the patient's photo by document ID or patient ID without verifying that the current user is authorized to access that patient. An authenticated user with document ACL can supply another patient's ID and retrieve their photo.

A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server.

OpenEMR before 7.0.0 contains a reflected cross-site scripting vulnerability in interface/forms/eye_mag/php/eye_mag_functions.php. Remote authenticated users can inject arbitrary web script or HTML via REQUEST_URI.