Stored XSS in OpenEMR Eye Exam Editor via PLAN[] Field

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in OpenEMR versions before 8.5.0. An authenticated user with Eye Exam edit permission can inject malicious scripts via the Next Visit Orders PLAN[] field. The payload is stored in the database and executes when another user opens the Eye Exam editor, potentially stealing session data or clinical information.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect OpenEMR Eye Exam forms for suspicious scripts in the Next Visit Orders PLAN[] field. Check view.php for improperly encoded user input in the ORDER_DETAILS field. Review database entries for HTML or JavaScript payloads in the Next Visit Orders field.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal your session cookies, access clinical data, or perform actions on your behalf within OpenEMR. This requires you to open an affected Eye Exam form after the attacker has injected the malicious script.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to protected health information (PHI), violating HIPAA requirements for safeguarding patient data. It may also result in data breaches that require notification under GDPR, potentially leading to fines or legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later. Apply input validation and output encoding to the Next Visit Orders field. Restrict Eye Exam edit permissions to trusted users only. Monitor for unauthorized script injections in form fields.

Useful 0 Not Useful 0