Kojiromike

An unsanitized deserialization issue allows authenticated attackers to manipulate patient-matching criteria. By providing a crafted serialized `key` parameter to the 'interface/orders/patient match dialog.php' endpoint, attackers can enumerate patients or force matches that associate lab orders with the incorrect patient. Deserialization is the process of converting a serialized string back into an object or data structure.

An improper authorization issue exists in the `ScopeRepository::finalizeScopes()` function. This occurs because the `ScopeEntity::containsScope()` function ignores registered permissions, allowing read-only SMART/OAuth clients to obtain write scopes. An attacker with a client registered for `user/<resource>.read` can request `user/<resource>.write` to create, update, and delete patient data or appointments.

An insecure direct object reference exists in the 'portal/lib/persist.php' endpoint. Authenticated portal patients can modify the settings of other patients by providing an arbitrary `setting patient` value. This allows attackers to insert or overwrite rows in the patient settings table to suppress notifications, tamper with consent flags, or alter portal preferences.

An improper authorization issue exists in the POST '/fhir/DocumentReference/$docref' endpoint. Users with low-level permissions for demographics and documents can provide a specific patient parameter to generate and download the full-chart CCDA (Continuity of Care Document) from Patient Documents, leading to the exfiltration of clinical data.

Broken access control in the 'portal/portal payment.php' endpoint allows authenticated users with low privileges to bypass billing Access Control List (ACL) checks. By tampering with the `pid` and `form pid` parameters, an attacker can view payment pages and record fraudulent payment receipts for arbitrary patients, leading to the corruption of billing records.