Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated attacker could craft a malicious form that, when submitted by a victim, executes arbitrary JavaScript in the victim's browser session. Version 8.0.0.3 patches the issue.
AnalysisAI
OpenEMR versions prior to 8.0.0.3 contain a stored cross-site scripting (XSS) vulnerability in form handling that allows authenticated attackers to inject malicious JavaScript into forms, which executes in the browser sessions of victims who submit those forms. An attacker with valid OpenEMR credentials can craft a malicious form that, upon submission by any user, executes arbitrary JavaScript with the privileges of the victim's session, potentially leading to session hijacking, credential theft, or unauthorized actions within the electronic health records system. The vulnerability is low-to-moderate severity (CVSS 5.4) due to the requirement for authentication and user interaction, but it poses significant risk in healthcare environments where attackers may have legitimate credentials and victims include healthcare providers with broad system access.
Technical ContextAI
This vulnerability represents a stored/persistent cross-site scripting (XSS) flaw classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically affecting the form submission and rendering mechanisms in OpenEMR's web application. The affected product is OpenEMR (cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*), a PHP-based electronic health records and medical practice management system. The root cause stems from insufficient input sanitization and output encoding when processing form data, allowing attackers to bypass form validation controls and inject unescaped JavaScript code that persists in the application's database. When another user submits or interacts with the compromised form, the malicious script executes within their authenticated browser context, inheriting their session tokens and permissions.
RemediationAI
Immediately upgrade OpenEMR to version 8.0.0.3 or later, which includes patches for form input sanitization and output encoding as detailed in the official release (https://github.com/openemr/openemr/releases/tag/v8_0_0_3). Review the security advisory at https://github.com/openemr/openemr/security/advisories/GHSA-cpph-949w-w79v for detailed vulnerability context and remediation guidance. If immediate patching is not feasible, implement compensating controls by restricting form creation and modification privileges to a minimal set of trusted administrators, disabling or removing unused form features, and monitoring form submissions for suspicious JavaScript patterns via web application firewall (WAF) rules. Additionally, review audit logs for any forms created or modified by untrusted accounts since the vulnerability's introduction, and consider rotating credentials for accounts that may have been compromised through stored XSS attack chains.
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today