Remote Code Execution in OpenEMR via Malicious Category Tree

Executive Summary

This is a remote code execution vulnerability in OpenEMR versions up to 8.2.0. It exists in the document category tree component where authenticated administrators can inject PHP payloads into the categories database table. The vulnerability allows altering the id column type to VARCHAR and inserting malicious PHP code. When any page loads CategoryTree, including unauthenticated pages, the unsanitized eval() call executes the payload, leading to arbitrary operating system command execution as the web server user.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized modifications to the categories database table in OpenEMR, particularly changes to the id column type to VARCHAR and PHP payloads in entries. Inspect library/classes/Tree.class.php for eval() calls that process category data.

Useful 0 Not Useful 0

Impact Analysis

An attacker with administrator access could exploit this to execute arbitrary commands on the server running OpenEMR. This could lead to full system compromise, data theft, installation of malware, or disruption of services. Even low-privilege users might trigger the vulnerability through unauthenticated pages, increasing the attack surface.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive patient or user data. A successful exploit could result in data breaches, unauthorized modifications, or disclosure of protected health information, leading to legal penalties, fines, and reputational damage for organizations handling regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to a patched version beyond 8.2.0. If immediate upgrade is not possible, restrict database write access for non-admin users and audit the categories table for malicious entries. Disable PHP eval() usage in Tree.class.php temporarily.

Useful 0 Not Useful 0