OpenEMR versions before 8.3.0 have an authorization bypass vulnerability in the billing interface that allows any authenticated user to access and modify billing data for any patient encounter. Exploitation involves iterating the 'id' parameter to read sensitive patient billing information and perform unauthorized actions such as posting payments, adjustments, deletions, or notes on any patient's account. This vulnerability was fixed in version 8.3.0.
OpenEMR versions prior to 8.3.0 contain an authorization bypass vulnerability in the portal_custom_report.php component. This flaw allows authenticated portal patients to access other patients' sensitive medical records by manipulating sequential IDs in request parameters. The exposed data includes problem titles, clinical notes, diagnosis codes, and contraceptive records. The vulnerability is fixed in OpenEMR version 8.3.0.
OpenEMR versions prior to 8.3.0 contain a critical SQL injection vulnerability in the Fee Sheet drug-inventory lookup functionality. This flaw allows low-privileged authenticated users to inject SQL code via the prod[N][warehouse] POST parameter, enabling time-based blind SQL injection attacks. Exploitation can lead to extraction of sensitive patient data and bcrypt hashes of user credentials. The vulnerability is fixed in version 8.3.0.
OpenEMR versions prior to 8.3.0 contain an SQL injection vulnerability in the Standard REST API endpoints for patient insurance and employer search. The flaw arises because query-string parameter names are concatenated directly into SQL statements as column identifiers without proper escaping. Authenticated users, including those with low-privilege patient-portal OAuth2 tokens, can exploit this to extract sensitive patient health information, user records, and API client secrets. The vulnerability is fixed in version 8.3.0.
OpenEMR versions prior to 8.4.0 contain a local file inclusion vulnerability in the ESign router due to improper sanitization of the module parameter. Authenticated attackers can upload a malicious PHP file named Controller.php via the fax module's upload functionality and then exploit a path traversal in the ESign router to execute arbitrary code. This vulnerability is fixed in version 8.4.0.
OpenEMR versions prior to 8.4.0 contain a server-side request forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to register an OAuth2 client with an unvalidated jwks_uri, enabling the server to send arbitrary HTTP requests. Attackers can exploit this via the token introspection endpoint using an unsigned client_assertion, potentially probing internal services and cloud metadata endpoints. The vulnerability is fixed in OpenEMR version 8.4.0.
OpenEMR versions prior to 8.4.0 have an authorization bypass vulnerability that allows patient-scoped SMART tokens to access questionnaire responses belonging to other patients. This occurs because the FhirQuestionnaireResponseService does not implement the required IPatientCompartmentResourceService interface, enabling attackers with a patient token to retrieve or list unfiltered questionnaire responses across patients.
OpenEMR versions prior to 8.3.0 contain a stored cross-site scripting (XSS) vulnerability that allows authenticated users with CAMOS access to inject malicious HTML content. This malicious content is saved via ajax_save.php and executes unencoded when printed through the non-print_html branch of rx_print.php. The vulnerability enables attackers to perform actions and read data with the privileges of the victim user.
OpenEMR versions prior to 8.3.0 have an authorization bypass vulnerability in the OnsiteDocumentController::Query() function. Authenticated portal patients can exploit this by supplying a capitalized Pid parameter, bypassing the lowercase pid authorization check. This allows them to access and read other patients' onsite documents containing protected health information (PHI).
OpenEMR versions prior to 8.3.0 have a missing authorization vulnerability in the library/ajax/upload.php component. This flaw allows any authenticated user, including low-privilege users, to read and overwrite document data by specifying arbitrary document IDs. Attackers can enumerate document IDs using fetch and save actions, leading to unauthorized disclosure of patient health information and tampering with medical records across all patients. The vulnerability is fixed in OpenEMR version 8.3.0.
OpenEMR versions prior to 8.3.0 have an authorization bypass vulnerability in the PortalPatientController::Read() function. Authenticated patients can exploit this flaw by supplying another patient's ID in the patientId query parameter to access pending demographic change requests of other patients. This unauthorized access exposes protected health information (PHI) including names, addresses, Social Security numbers, and insurance details. The vulnerability is fixed in OpenEMR version 8.3.0.
OpenEMR versions before 8.3.0 have an authorization bypass vulnerability due to insecure direct object references in encounter-form view and save endpoints. Authenticated clinical users can enumerate sequential form IDs to access and modify other patients' clinical records without proper ownership checks. This flaw was fixed in version 8.3.0.
OpenEMR versions before 8.4.0 have an authorization bypass vulnerability in the FHIR GET /fhir/Person/:uuid endpoint. This flaw allows patient-portal users to access staff member demographic information by circumventing compartment enforcement. Attackers with a patient SMART token possessing patient/Person.read permission can extract staff Person UUIDs from Appointment references and retrieve sensitive personal data such as names, home addresses, phone numbers, and personal emails. The vulnerability is fixed in OpenEMR version 8.4.0.
OpenEMR versions prior to 8.3.0 have a path traversal vulnerability in the interface/billing/sl_eob_process.php component. This flaw allows authenticated users to write and read files by supplying unsanitized 'eraname' values. Attackers without billing privileges can exploit this to inject directory traversal sequences (../) to create ERA report .html files in arbitrary writable locations and parse arbitrary .edi files echoed into the report.
OpenEMR versions prior to 8.3.0 contain missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module. These flaws allow authenticated low-privilege users to access and modify other patients' records, including sensitive information such as names, medical record numbers (MRNs), insurance, and prior authorization data. Attackers can exploit endpoints like public/reports/list_report.php to view patient data or submit arbitrary IDs to public/index.php to overwrite prior-authorization records. The issue is fixed in OpenEMR version 8.3.0.
OpenEMR versions prior to 8.3.0 contain an authorization bypass vulnerability in the OnsiteDocumentController::Query() function. Authenticated portal patients can manipulate request parameters to access other patients' documents, including sensitive health information and signed consent forms. This flaw allows unauthorized reading of protected health information (PHI).
OpenEMR versions prior to 8.3.0 contain an authorization bypass vulnerability in portal/lib/persist.php. Authenticated portal patients can exploit this flaw by modifying the setting_patient parameter in a JSON POST request to change another patient's portal settings, such as the portal theme. This issue is fixed in version 8.3.0.
OpenEMR versions before 8.3.0 contain a stored cross-site scripting (XSS) vulnerability in the eye_mag report generation feature. Authenticated users with document-note write access can inject malicious JavaScript into retina document notes. This script executes when clinicians generate the Eye Exam patient report, potentially exposing session cookies. The vulnerability is fixed in version 8.3.0.
OpenEMR versions prior to 8.4.0 have an authorization bypass vulnerability in the SMART on FHIR implementation. The function checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php always returns true, allowing authenticated users or malicious SMART apps to manipulate token launch context. This manipulation can bind requests to arbitrary patient UUIDs, enabling unauthorized read and write access to other patients' FHIR resources. The issue is fixed in version 8.4.0.
OpenEMR versions prior to 8.3.0 have a critical vulnerability in the fax/sms module's disposeDocument action. This flaw allows authenticated low-privilege users to exploit broken access control and path traversal via an unvalidated file_path parameter. Exploitation can lead to reading sensitive configuration files such as sqlconf.php, exposing database credentials, and writing arbitrary files as the web user, which enables remote code execution.