Stored XSS in OpenEMR via Billing Code Injection

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in OpenEMR versions before 8.5.0. It occurs in the file interface/billing/sl_eob_invoice.php where billing codes are improperly escaped. A clinician with access can save a malicious billing code containing JavaScript that executes when a Back Office user enters a payment. The code runs in the authenticated session of the EOB user, potentially exposing patient and financial data or allowing unauthorized actions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect OpenEMR installations for versions prior to 8.5.0. Check the file interface/billing/sl_eob_invoice.php for improper escaping of billing codes in JavaScript strings. Review saved billing codes in diagnosis.php for suspicious JavaScript payloads.

Useful 0 Not Useful 0

Impact Analysis

If you are a Back Office user in OpenEMR, an attacker with clinician access could steal your session data, view or modify patient records, or perform billing actions on your behalf. Patient data, including sensitive information, could be exposed or altered. The impact depends on your role and the permissions of the compromised account.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to protected health information (PHI), violating HIPAA requirements for confidentiality and integrity. Under GDPR, it may result in unauthorized processing of personal data, triggering breach notification obligations. Both standards emphasize protecting sensitive data, and this flaw undermines those protections.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later immediately. If upgrading is not possible, apply a patch from the OpenEMR security advisory. Review and remove any suspicious billing codes in the system. Monitor for unusual activity in EOB forms.

Useful 0 Not Useful 0