OpenEMR versions prior to 8.3.0 have a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php. This flaw allows low-privileged authenticated users to modify recall data of arbitrary patients by submitting crafted parameters, potentially overwriting sensitive patient records. The issue is fixed in version 8.3.0.
OpenEMR versions prior to 8.3.0 have a missing authorization vulnerability that permits low-privileged authenticated users to delete arbitrary patient recall records. This occurs via the delete_Recall action by sending crafted POST requests to /interface/main/messages/save.php with specific patient and recall IDs, bypassing access control checks.
OpenEMR versions prior to 8.3.0 contain an authorization bypass vulnerability in portal/lib/paylib.php. The application fails to verify that the patient ID submitted in payment-related requests matches the authenticated session patient. This allows authenticated portal patients to insert or modify payment audit records of other patients, potentially compromising billing data integrity.
OpenEMR versions prior to 8.3.0 contain an authorization bypass vulnerability in portal/lib/persist.php. Authenticated portal patients can manipulate the setting_patient parameter to modify other patients' settings, including suppressing notifications, altering consent flags, or changing portal preferences. This vulnerability is fixed in version 8.3.0.
OpenEMR versions prior to 8.3.0 have a broken object-level authorization vulnerability in the SOAP note update API. Authenticated users with encounters/notes permission can overwrite clinical notes belonging to other patients by supplying a SOAP note ID (sid) that does not belong to the specified patient and encounter. This allows unauthorized modification and reassignment of clinical notes.
OpenEMR versions before 8.3.0 have a missing authorization vulnerability in the billing notes interface that allows any authenticated user, including those with low privileges, to read and modify patient billing notes. This occurs due to insufficient access controls on the patient_id parameter and the ability to submit POST requests with a valid CSRF token. The vulnerability is fixed in version 8.3.0.
OpenEMR versions before 8.3.0 have an authorization bypass vulnerability in the billing interface that allows any authenticated user to access and modify billing data for any patient encounter. Exploitation involves iterating the 'id' parameter to read sensitive patient billing information and perform unauthorized actions such as posting payments, adjustments, deletions, or notes on any patient's account. This vulnerability was fixed in version 8.3.0.
OpenEMR versions prior to 8.3.0 contain an authorization bypass vulnerability in the portal_custom_report.php component. This flaw allows authenticated portal patients to access other patients' sensitive medical records by manipulating sequential IDs in request parameters. The exposed data includes problem titles, clinical notes, diagnosis codes, and contraceptive records. The vulnerability is fixed in OpenEMR version 8.3.0.
OpenEMR versions prior to 8.3.0 contain a critical SQL injection vulnerability in the Fee Sheet drug-inventory lookup functionality. This flaw allows low-privileged authenticated users to inject SQL code via the prod[N][warehouse] POST parameter, enabling time-based blind SQL injection attacks. Exploitation can lead to extraction of sensitive patient data and bcrypt hashes of user credentials. The vulnerability is fixed in version 8.3.0.
OpenEMR versions prior to 8.3.0 contain an SQL injection vulnerability in the Standard REST API endpoints for patient insurance and employer search. The flaw arises because query-string parameter names are concatenated directly into SQL statements as column identifiers without proper escaping. Authenticated users, including those with low-privilege patient-portal OAuth2 tokens, can exploit this to extract sensitive patient health information, user records, and API client secrets. The vulnerability is fixed in version 8.3.0.
OpenEMR versions prior to 8.4.0 contain a local file inclusion vulnerability in the ESign router due to improper sanitization of the module parameter. Authenticated attackers can upload a malicious PHP file named Controller.php via the fax module's upload functionality and then exploit a path traversal in the ESign router to execute arbitrary code. This vulnerability is fixed in version 8.4.0.
OpenEMR versions prior to 8.4.0 contain a server-side request forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to register an OAuth2 client with an unvalidated jwks_uri, enabling the server to send arbitrary HTTP requests. Attackers can exploit this via the token introspection endpoint using an unsigned client_assertion, potentially probing internal services and cloud metadata endpoints. The vulnerability is fixed in OpenEMR version 8.4.0.
OpenEMR versions prior to 8.4.0 have an authorization bypass vulnerability that allows patient-scoped SMART tokens to access questionnaire responses belonging to other patients. This occurs because the FhirQuestionnaireResponseService does not implement the required IPatientCompartmentResourceService interface, enabling attackers with a patient token to retrieve or list unfiltered questionnaire responses across patients.
OpenEMR versions prior to 8.3.0 contain a stored cross-site scripting (XSS) vulnerability that allows authenticated users with CAMOS access to inject malicious HTML content. This malicious content is saved via ajax_save.php and executes unencoded when printed through the non-print_html branch of rx_print.php. The vulnerability enables attackers to perform actions and read data with the privileges of the victim user.
OpenEMR versions prior to 8.3.0 have an authorization bypass vulnerability in the OnsiteDocumentController::Query() function. Authenticated portal patients can exploit this by supplying a capitalized Pid parameter, bypassing the lowercase pid authorization check. This allows them to access and read other patients' onsite documents containing protected health information (PHI).
OpenEMR versions prior to 8.3.0 have a missing authorization vulnerability in the library/ajax/upload.php component. This flaw allows any authenticated user, including low-privilege users, to read and overwrite document data by specifying arbitrary document IDs. Attackers can enumerate document IDs using fetch and save actions, leading to unauthorized disclosure of patient health information and tampering with medical records across all patients. The vulnerability is fixed in OpenEMR version 8.3.0.
OpenEMR versions prior to 8.3.0 have an authorization bypass vulnerability in the PortalPatientController::Read() function. Authenticated patients can exploit this flaw by supplying another patient's ID in the patientId query parameter to access pending demographic change requests of other patients. This unauthorized access exposes protected health information (PHI) including names, addresses, Social Security numbers, and insurance details. The vulnerability is fixed in OpenEMR version 8.3.0.
OpenEMR versions before 8.3.0 have an authorization bypass vulnerability due to insecure direct object references in encounter-form view and save endpoints. Authenticated clinical users can enumerate sequential form IDs to access and modify other patients' clinical records without proper ownership checks. This flaw was fixed in version 8.3.0.
OpenEMR versions before 8.4.0 have an authorization bypass vulnerability in the FHIR GET /fhir/Person/:uuid endpoint. This flaw allows patient-portal users to access staff member demographic information by circumventing compartment enforcement. Attackers with a patient SMART token possessing patient/Person.read permission can extract staff Person UUIDs from Appointment references and retrieve sensitive personal data such as names, home addresses, phone numbers, and personal emails. The vulnerability is fixed in OpenEMR version 8.4.0.
OpenEMR versions prior to 8.3.0 have a path traversal vulnerability in the interface/billing/sl_eob_process.php component. This flaw allows authenticated users to write and read files by supplying unsanitized 'eraname' values. Attackers without billing privileges can exploit this to inject directory traversal sequences (../) to create ERA report .html files in arbitrary writable locations and parse arbitrary .edi files echoed into the report.