openemr vulnerabilities and threats

OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values in the form_icd_codes[] POST parameter to the syndromicsurveillance/index endpoint. Attackers can inject an unquoted numeric IN() clause and UNION DISTINCT SELECT statement using hex-encoded literals to abuse MySQL extractvalue() for error-based exfiltration of bcrypt password hashes and execute stacked queries that reset passwords, resulting in full administrative account takeover.

OpenEMR versions before 8.3.0 have a path traversal vulnerability in the EDI archive restore function. An authenticated user with EOB Data Entry permissions can manipulate the archrestore_sel POST parameter to probe arbitrary filesystem paths. The vulnerability arises because the parameter is not sanitized for path traversal sequences, and differing response messages reveal whether a target path exists on the server.

OpenEMR versions before 8.3.0 have a cross-site request forgery (CSRF) vulnerability in the DICOM viewer. The vulnerability arises because the web_path GET parameter is embedded unsanitized as a URL without validation. This allows an attacker to craft a malicious URL that causes an authenticated user with Patients - Documents permissions to perform unintended authenticated requests, such as forced logout or other state-changing actions.

OpenEMR versions before 8.3.0 have a stored cross-site scripting (XSS) vulnerability in the patient portal template import handler. Authenticated users with Forms Administration permissions can upload template files containing malicious HTML or JavaScript. These scripts are stored without proper sanitization and execute in the browsers of other Forms Administration users who view the templates in the HTML editor.

OpenEMR versions before 8.3.0 have a reflected cross-site scripting (XSS) vulnerability in the patient portal template import handler. The vulnerability arises because the templateHtml GET parameter is not properly sanitized before being reflected in the page response. An attacker can exploit this by crafting a URL that executes arbitrary JavaScript in the browser of any authenticated user with Forms Administration permissions who clicks the link, potentially leading to session hijacking.

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard_tables_manage.php interface where the db GET parameter is passed without validation to temp_dir_cleanup(), which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers can supply a traversal sequence in the db parameter to resolve outside the intended temporary directory, and by chaining this with an open redirect in dicom_frame.php, an unauthenticated attacker can deliver a crafted URL that triggers arbitrary recursive directory deletion within an authenticated Superuser's session.

OpenEMR versions prior to 8.0.0 contain an authorization bypass vulnerability in the document controller's patient_picture context. Authenticated users with document ACL can access patient photos by supplying another patient's ID without proper authorization checks. This issue is resolved in version 8.0.0.