Bradymiller

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0 **Description** OpenEMR is an electronic health records and medical practice management application. Versions prior to 8.0.0 have an information disclosure issue that exposes contact information for users, organizations, and patients to individuals with the system/(Group,Patient,*).$export operation and system/Location.read capabilities. This disclosure requires a confidential client with secure key exchange, which needs to be enabled and granted permission by an administrator. This typically occurs in server-server communication between trusted clients with existing legal agreements. The vulnerable functionality involves the `$export` operation and the `system/Location.read` capability. **Recommendations** Disable clients that have the vulnerable scopes. Only allow clients that do not have the `system/Location.read` scope until a fix has been deployed.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 8.0.0 **Description** OpenEMR is an electronic health records and medical practice management application. Before version 8.0.0, the `xl()` translation function does not properly escape strings. The application includes wrapper functions for escaping in different contexts (`xlt()` for HTML, `xla()` for attributes, `xlj()` for JavaScript), but the `xl()` function’s output is sometimes used directly without escaping. If an attacker can inject malicious content into the translation database, this could lead to cross-site scripting (XSS). The `xl()` function is used to retrieve translated strings. **Recommendations** Update to version 8.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 7.3.0 **Description** The issue concerns a Directory Traversal vulnerability in the Load Code feature of OpenEMR, a free and open source electronic health records and medical practice management application. **Recommendations** For versions prior to 7.3.0, update to version 7.3.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 5.0.1.4 **Description** The issue allows a remote authenticated attacker to execute arbitrary SQL commands. This is achieved via the `text` parameter in the interface/patient file/encounter/search code.php file. **Recommendations** For versions prior to 5.0.1.4, update to version 5.0.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the search code.php file to minimize the risk of exploitation. Avoid using the `text` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 5.0.1.4 **Description** The issue allows a remote authenticated attacker to execute arbitrary SQL commands. This is achieved via the `search term` parameter in the interface/de identification forms/find code popup.php file. **Recommendations** For versions prior to 5.0.1.4, update to version 5.0.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the interface/de identification forms/find code popup.php file to minimize the risk of exploitation. Avoid using the `search term` parameter in the affected file until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 5.0.1.4 **Description** The issue allows a remote authenticated attacker to execute arbitrary SQL commands. This is achieved via the `search term` parameter in the interface/de identification forms/find immunization popup.php file. **Recommendations** For versions prior to 5.0.1.4, update to version 5.0.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the interface/de identification forms/find immunization popup.php file to minimize the risk of exploitation. Avoid using the `search term` parameter in the affected file until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 5.0.1.4 **Description** The issue allows a remote authenticated attacker to execute arbitrary SQL commands. This is achieved via the `id` parameter in the interface/forms admin/forms admin.php file, which is affected by the SQL injection vulnerability. The library/registry.inc file is also involved in this issue. **Recommendations** For versions prior to 5.0.1.4, update to version 5.0.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the 'id' parameter in the affected interface to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenEMR versions prior to 5.0.1.4 **Description** The issue allows a remote authenticated attacker to execute arbitrary SQL commands. This is achieved via the `search term` parameter in the interface/de identification forms/find drug popup.php file. **Recommendations** For versions prior to 5.0.1.4, update to version 5.0.1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the interface/de identification forms/find drug popup.php file to minimize the risk of exploitation. Avoid using the `search term` parameter in the affected file until the issue is resolved.