OpenEMR Missing Authorization in Destroyed Drugs Report

Executive Summary

OpenEMR before version 8.5.0 has a missing authorization vulnerability in destroyed_drugs_report.php. This flaw allows any authenticated core user to access destroyed-drug records without proper admin or inventory reporting permissions. Attackers can exploit this by submitting a report refresh form with a chosen date range to retrieve sensitive drug information.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR logs for unauthorized access to destroyed_drugs_report.php. Monitor network traffic for repeated requests to this endpoint with varying date ranges. Review user activity logs for core users accessing drug inventory reports outside normal workflows.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized users to view confidential drug destruction records, including drug names, NDC codes, lot numbers, quantities, destruction methods, witnesses, and notes. This may lead to data breaches, unauthorized disclosure of sensitive information, or compliance violations depending on the organization's policies.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance with regulations like HIPAA or GDPR by exposing protected health information or personal data without proper authorization. Organizations handling such data may face legal penalties, reputational damage, or loss of trust due to unauthorized access to sensitive records.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later. Apply ACL checks to destroyed_drugs_report.php to restrict access to admin/drugs or inventory/reporting roles. Review and revoke any unauthorized user permissions for drug inventory access.

Useful 0 Not Useful 0