OpenEMR (< 8.3.0)

OpenEMR versions prior to 8.3.0 are susceptible to time-based blind SQL injection in the Fee Sheet component, allowing low-privileged authenticated users to exfiltrate patient data and user hashes.

OpenEMR versions before 8.3.0 contain an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to write settings for other patients.

OpenEMR versions prior to 8.3.0 contain an authorization bypass in the sl_eob_invoice.php script that allows authenticated users to read and modify arbitrary billing records via parameter manipulation.

OpenEMR versions prior to 8.3.0 contain a stored cross-site scripting vulnerability allowing authenticated users with CAMOS access to execute arbitrary scripts in a victim context.

OpenEMR versions prior to 8.3.0 are vulnerable to path traversal in the fax/sms module, allowing authenticated attackers to read sensitive files and execute arbitrary code via file write.

OpenEMR versions prior to 8.3.0 are vulnerable to broken access control, allowing authenticated, low-privileged users to modify patient identifiers to bypass billing restrictions and record fraudulent payments.

OpenEMR versions prior to 8.3.0 are vulnerable to an authorization bypass allowing authenticated, low-privileged users to delete arbitrary patient recall records via the delete_Recall action.

OpenEMR versions prior to 8.3.0 contain a broken object-level authorization vulnerability that allows authenticated users to overwrite clinical notes belonging to other patients by manipulating the SOAP note ID in API requests.

OpenEMR versions prior to 8.3.0 are vulnerable to a missing authorization flaw allowing authenticated low-privileged users to read and modify sensitive patient billing notes via parameter manipulation.

OpenEMR versions prior to 8.3.0 are susceptible to an authorization bypass vulnerability allowing authenticated users to read and overwrite arbitrary document data via the library/ajax/upload.php script.

OpenEMR versions prior to 8.3.0 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated users to access and modify clinical records belonging to other patients by enumerating form IDs.

OpenEMR versions before 8.3.0 contain IDOR and authorization flaws in the oe-module-prior-authorizations module that allow authenticated users to access and modify patient records.

OpenEMR versions before 8.3.0 are vulnerable to stored cross-site scripting via maliciously crafted CCDA/CCD document attachments that execute scripts in a clinician's session upon preview.

OpenEMR versions prior to 8.3.0 contain an Insecure Direct Object Reference vulnerability in the OnsitePortalActivityController::Update() function that allows authenticated portal patients to access, modify, and assume ownership of records belonging to other patients.

OpenEMR versions prior to 8.3.0 are vulnerable to path traversal within the RingCentral RCFaxClient disposeDocument() method, enabling authenticated attackers to read arbitrary files or achieve remote code execution via file writes.