Missing Authorization in OpenEMR FaxSMS Module Creates Fake Patient Charts

Executive Summary

This vulnerability is a missing authorization flaw in OpenEMR versions before 8.5.0. It exists in the FaxSMS module's utility.php file and allows users with read-only demographics access to create patient charts. Attackers can submit a form_create request with chosen identity fields to generate fake or duplicate patient records, including employer, history, and insurance details.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR versions prior to 8.5.0 by running: grep -r '"version"' /var/www/html/openemr/library/version.php or check the admin dashboard. Inspect FaxSMS module logs for unauthorized form_create requests in utility.php. Monitor for duplicate patient records or unexpected chart creations in the database.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to create fictitious or duplicate patient records in the system. This may lead to polluted clinical workflows, duplicate charts, or false identity integrations. It could also enable attackers to manipulate patient data, including sensitive information like employer, history, and insurance records.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later immediately. Review and restrict permissions for the FaxSMS module to ensure only authorized users can create patient charts. Audit existing patient records for duplicates or anomalies created by this flaw.

Useful 0 Not Useful 0