Zipline versions from 4.3.0 up to but not including 4.5.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated low-privilege users to inject malicious HTML and JavaScript via unescaped embed settings in server-side rendered meta tags. Specifically, attackers can manipulate embedTitle, embedDescription, embedSiteName, or embedColor values through the PATCH /api/user endpoint. When other users visit the affected file view pages, the injected script executes in their browsers.
Zipline versions before 4.5.1 have a stored cross-site scripting (XSS) vulnerability in the HighlightCode component. This flaw allows authenticated users to upload text files with malicious HTML/JavaScript that execute in other users' browsers when the file content is rendered unescaped. The vulnerability enables attackers to perform actions such as changing account details on behalf of victims.
Zipline versions from 4.2.0 up to but not including 4.6.2 have an information disclosure vulnerability where sensitive environment variables, including OAuth2 client secrets, are logged without redaction at startup. This allows attackers with access to system or Docker logs to retrieve these secrets and potentially exchange intercepted OAuth2 callbacks for valid tokens.
Zipline versions before 4.6.1 have a path traversal vulnerability in the LocalDatasource component. This flaw allows users with SUPERADMIN privileges to read or delete files outside the designated upload directory by importing records with specially crafted traversal filenames. The vulnerability can be exploited by triggering unchecked byte-range requests or by setting expired deletion times, enabling unauthorized file deletion accessible to the Zipline process.
Zipline versions before 4.6.2 have a missing authorization vulnerability in the POST /api/user/folders endpoint. Authenticated users can exploit this flaw to reparent files belonging to other users by supplying their file IDs. Attackers can gather these file IDs from public folders, create a folder containing them, and thereby disclose the victims' file URLs while removing those files from the victims' folder views.
OpenEMR versions prior to 8.5.0 have a second-order SQL injection vulnerability in the IPPF contraceptive issue feature. This occurs because the issue_ippf_con_save function concatenates user-controlled field_id values into a SQL REPLACE INTO query as column names. Authenticated administrators can exploit this by adding a malicious field_id via edit_layout.php and then triggering the vulnerable function through add_edit_issue.php, allowing arbitrary SQL execution.
Zipline versions through 4.6.2 have an authorization bypass vulnerability allowing authenticated administrators to access superadmin secrets. The API endpoints GET /api/users and GET /api/users/:id do not enforce the canInteract check, enabling attackers to retrieve plaintext totpSecret and OAuth tokens. This can allow bypassing two-factor authentication and takeover of superadmin accounts. Additionally, any authenticated user can enumerate other users' folders via GET /api/user/folders.
OpenEMR versions prior to 8.4.0 have an improper authorization vulnerability in the ScopeRepository::finalizeScopes() function. This flaw allows read-only SMART/OAuth clients to escalate privileges and obtain write scopes. Specifically, ScopeEntity::containsScope() does not properly enforce registered permissions, enabling attackers with a client registered for user/<resource>.read to request user/<resource>.write scopes. This can lead to unauthorized creation, modification, or deletion of appointments or patient data.
OpenEMR versions before 8.5.0 have a stored cross-site scripting (XSS) vulnerability in the onsiteportalactivity API. This flaw allows low-privileged patient portal users to inject JavaScript code via the tableArgs field. The injected script executes when providers click the delete button on the audit review page due to improper handling of an unquoted data-delete-id attribute.
OpenEMR versions prior to 8.5.0 have a stored SQL injection vulnerability in the getByPatientDemographics() function. This flaw arises because layout_options field_id values are concatenated directly into the patient search WHERE clause. An attacker with Layout Editor privileges can insert a malicious field_id, enabling any authenticated low-privilege user to exfiltrate sensitive data from patient_data and users_secure tables.
OpenEMR versions prior to 8.5.0 contain a second-order SQL injection vulnerability that allows low-privileged authenticated users to inject malicious SQL code. The vulnerability arises from the ability to store a SQL fragment in the recent_patient_columns option_id value via library/ajax/addlistitem.php, which is later concatenated and executed in dynamic_finder.php. This flaw can lead to high confidentiality impact by exposing sensitive data.
Zipline versions before 4.6.5 have a time-of-check to time-of-use (TOCTOU) race condition in the POST /api/setup endpoint. This flaw allows unauthenticated attackers to create multiple SUPERADMIN accounts by sending concurrent requests before the firstSetup flag is reset. Exploitation requires racing requests with spoofed X-Forwarded-For headers during the argon2 password hashing process. This vulnerability can lead to full administrative control of the affected Zipline instance.
OpenEMR versions prior to 8.5.0 have an SQL injection vulnerability in the patient portal's OnsiteDocument.Query endpoint. This flaw allows authenticated patients to inject SQL commands beyond their own data scope, potentially exposing the entire database including other patients' personal information and password hashes.
Zipline versions before 4.6.4 have an information disclosure vulnerability in the GET /api/server/folder/:id endpoint. This flaw allows unauthenticated attackers who know a folder's UUID to list files in non-public upload-only folders. By manipulating the page query parameter, attackers can bypass metadata-only restrictions and enumerate file details such as names, IDs, MIME types, sizes, and view counts.
Zipline versions prior to 4.7.0 have a race condition vulnerability that enables users to bypass limits on invitation usage, upload storage, and shortened-URL creation by making concurrent requests. This flaw allows attackers to circumvent checks based on stale state, resulting in creation of extra accounts and exceeding resource quotas set by administrators.
Zipline versions prior to 4.6.4 have a vulnerability that allows remote attackers to bypass rate limiting by manipulating query strings or using a specific header. This enables attackers to perform credential guessing attacks beyond intended request limits on login and password verification endpoints.
OpenEMR versions prior to 8.5.0 contain active debug code in the interface/fax/fax_view.php file that executes the passthru("groups") command. This causes disclosure of the web server's Unix group memberships. Authenticated users with access to the fax module can exploit this by supplying a nonexistent jid value to reveal sensitive group information such as adm or shadow, which could assist in planning privilege escalation attacks.
Zipline versions before 4.6.4 have a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by manipulating Content-Range headers. This enables attackers to send small chunks with large declared offsets, causing the server to allocate excessive disk space and potentially exhaust storage resources.
OpenEMR versions prior to 8.5.0 contain an SQL injection vulnerability in the SLEOB::slInvoiceNumber() function within src/Billing/SLEOB.php. This vulnerability arises because the CLP01 claim identifier from uploaded X12 835 ERA files is concatenated directly into an SQL query without proper escaping or parameter binding. Authenticated users with billing permissions or malicious payers whose ERA files are uploaded by clerks can exploit this flaw to execute arbitrary SQL commands, potentially reading sensitive data such as password hashes and modifying database contents.
OpenEMR versions prior to 8.5.0 contain an SQL injection vulnerability in the ippf_statistics.php report interface. Authenticated users with report access can manipulate the form_facility parameter to inject SQL code, potentially reading sensitive database information. The vulnerability allows attackers to close string literals in the facility_id WHERE clause and use boolean or time-based payloads. The CVSS score is 6.5, indicating a medium severity impact with high confidentiality impact but no integrity or availability impact.