Farisv

OpenEMR before 8.5.0 contains a missing authorization vulnerability in interface/forms/procedure order/common.php that allows authenticated accounts lacking patients/lab permission to read and modify other patients' procedure orders. Attackers can request a global order id to disclose clinical history, or select the target patient in their session and submit bn save to falsify diagnoses, instructions, and order status.

OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/download template.php that allows any authenticated core user to render documents for arbitrary patients by setting isModule. Attackers can submit arbitrary pid and template id values to disclose patient names, birth dates, chart IDs, addresses, allergies, medications, and problem lists despite ACL and squad restrictions.

OpenEMR before 8.5.0 contains a remote code execution vulnerability that allows authenticated billing users to store attacker-controlled PHP by uploading a malformed ERA file to era payments.php. Attackers with a database-write primitive such as SQL injection can register a background services row whose require once loads the stored .edi file, executing PHP as the web-server user.

OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination users to store malicious C-CDA field identifiers through the savedata action. Attackers can inject SQL into the IN clause built by fetchFormValues() during C-CDA generation to extract password hashes, portal reset values, and patient records.

OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order manifest.php, which checks patients/med without requiring write access or applying patient squad restrictions. Users with only patients/med view permission can request any order ID to read squad-restricted patient data and submit bn save and form omit parameters, without a CSRF token, to set do not send flags that suppress ordered lab procedures.

OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/list reports.php that allows read-only users to transmit lab orders because the patients/med check ignores write permission. Authenticated attackers can submit form xmit with arbitrary procedure order IDs to send HL7 orders containing SSNs, insurance, and diagnoses to laboratories and mark them transmitted.

OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries into memory without size or ratio checks. Authenticated billing or Carecoordination users can upload highly compressed ZIP archives to exhaust PHP memory and worker pools, making OpenEMR unavailable.

OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved through edit layout.php, including HIS fields and LBF source-H fields, are placed unvalidated into an INSERT statement for patients without a history data row. Users with admin/super and patients/med write access can trigger history save.php or LBF saves to execute SQL functions like SLEEP, tying up database workers or accessing data beyond their privileges.

OpenEMR before 8.5.0 passes authenticated user-controlled HTML from the doc lib.php content parameter to mPDF, which resolves local files and nested SVG resources. Authenticated patients or core users can submit crafted CSS imports or php://filter SVG references to read arbitrary server files including credentials and OAuth keys.

OpenEMR before 8.5.0 contains an sql injection vulnerability that allows any authenticated core user to inject SQL by supplying crafted patient data field names to the CCR revandapprove controller. Attackers can embed scalar subqueries in the UPDATE patient data SET clause to read staff password hashes and portal reset values, alter arbitrary patient demographics, and take over patient-portal accounts.

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows users with admin/superbill write permission to inject HTML into SNOMED code descriptions via superbill custom full.php. When a clinician selects the malicious code, the Functional and Cognitive Status form or fee-sheet forms assign it to innerHTML, executing JavaScript in the clinician's session to read patient data and perform actions.

OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/drugs/dispense drug.php, which checks only for admin/drugs view permission instead of write permission before dispensing medication. Authenticated users with read-only drug administration access can send GET requests with drug id, quantity, fee, and encounter parameters to create false dispensing records and decrement inventory.

Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to read arbitrary files by supplying ../ sequences in the filePath of patch.readRepoFile. Attackers with service read permission can read /etc/shadow, SSH private keys, and secret environment files on the Dokploy host or managed remote servers.

OpenEMR before 8.5.0 contains an access control flaw in get claim file.php: with location=tmp, it serves any file in the shared temporary directory without verifying the file is a claim for the caller. Users with acct/eob or acct/bill write access can request key=ccda.xml to download the most recently validated patient's complete C-CDA clinical document.

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sl eob invoice.php, which escapes billing codes for HTML attributes but not for JavaScript strings in an inline onkeyup handler. Clinicians with encounter coding access can save crafted billing codes through diagnosis.php that execute script when a Back Office user enters a payment, exposing patient and financial data or performing actions as that user.

OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esign form submit handler of library/ESign/Form/Controller.php that verifies only the caller's password, not access to the patient, encounter, or form type. Authenticated core users can supply arbitrary formId, formDir, and encounterId values to sign and lock any patient's clinical form, creating unauthorized approval records and blocking normal editing.

OpenEMR before 8.5.0 contains a missing authorization vulnerability in the FaxSMS module's utility.php that allows read-only demographics users to create patient charts. Attackers can submit the form create request with chosen identity fields to create fictitious or duplicate patients with employer, history, and insurance records.

OpenEMR before 8.5.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users with patients/med access to exhaust PHP workers via an unbounded count parameter. Attackers can send print labels requests to labs ajax.php with huge counts, forcing mPDF page and barcode generation that makes OpenEMR unavailable.

OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/lists touch.php that allows restricted authenticated users to mark another patient's clinical lists as reviewed. Attackers can submit arbitrary patient id and type values to falsely record "None known" allergy, medication, or problem lists, misleading clinicians and skewing quality-measure calculations.

OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/patient file/rules/patient data.php that allows read-only patients/med users to modify clinical-rule records. Attackers can submit a global form entryID row ID to overwrite completion date, state, and result, including records of patients outside their configured squad.