https://feed.craftedsignal.io/products/openemr/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 12:00:00 +0000https://feed.craftedsignal.io/briefs/2024-01-openemr-xss/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-openemr-xss/A stored cross-site scripting (XSS) vulnerability in OpenEMR's CCDA document preview (CVE-2026-33932) allows an attacker to execute arbitrary JavaScript in a clinician's browser session by uploading a malicious CCDA document.A stored cross-site scripting (XSS) vulnerability has been identified in OpenEMR, a widely used open-source electronic health records and medical practice management application. Specifically, the vulnerability resides within the CCDA (Consolidated Clinical Document Architecture) document preview feature. Prior to version 8.0.0.3, an attacker with the ability to upload or send a CCDA document can inject malicious JavaScript code. When a clinician previews the booby-trapped document, the injected script executes within their browser session. This is due to insufficient sanitization of the linkHtml attribute in the XSL stylesheet used for rendering CCDA documents. The vulnerability, identified as CVE-2026-33932, allows href="javascript:..." and event handler attributes to pass through unfiltered. OpenEMR version 8.0.0.3 addresses this critical security flaw.

Attack Chain

1. An attacker identifies an OpenEMR instance running a vulnerable version (prior to 8.0.0.3).
2. The attacker crafts a malicious CCDA document containing a linkHtml attribute with a JavaScript payload, such as <linkHtml href="javascript:alert('XSS')">.
3. The attacker uploads the malicious CCDA document to the OpenEMR instance, potentially through patient record upload functionality or direct messaging features.
4. A clinician or authorized user accesses the patient record containing the malicious CCDA document.
5. The clinician previews the CCDA document within the OpenEMR interface.
6. The OpenEMR application processes the CCDA document using the vulnerable XSL stylesheet.
7. Due to the lack of proper sanitization, the JavaScript payload within the linkHtml attribute is rendered in the clinician's browser.
8. The JavaScript code executes in the clinician's browser session, potentially allowing the attacker to steal session cookies, redirect the user to a phishing site, or perform other malicious actions within the context of the OpenEMR application.

Impact

Successful exploitation of this XSS vulnerability can lead to several damaging consequences. An attacker could steal a clinician's session cookies, gaining unauthorized access to sensitive patient data. They could also redirect users to phishing sites to harvest credentials or inject malicious code into the OpenEMR application to compromise its functionality. Given the sensitive nature of electronic health records, a successful attack could result in significant privacy breaches, regulatory violations (HIPAA), and reputational damage to the healthcare provider. While the specific number of affected organizations is unknown, OpenEMR is used by numerous healthcare providers globally, placing a large patient population at risk.

Recommendation

• Upgrade OpenEMR to version 8.0.0.3 or later to patch the CVE-2026-33932 vulnerability.
• Deploy the Sigma rule "Detect Suspicious OpenEMR CCDA Document Preview" to your SIEM and tune for your environment, monitoring webserver logs for requests containing suspicious patterns in the URI.
• Implement input validation and sanitization measures for all user-supplied data within the OpenEMR application, focusing on CCDA document processing.
• Educate clinicians and other OpenEMR users about the risks of XSS attacks and the importance of reporting any suspicious activity.

]]>mediumadvisoryopenemrxsscve-2026-33932health-recordshttps://feed.craftedsignal.io/briefs/2024-01-openemr-sql-injection/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-openemr-sql-injection/A blind SQL injection vulnerability exists in the PostCalendar module of OpenEMR versions prior to 8.0.0.3 due to improper sanitization of the `dels` POST parameter, potentially allowing attackers to execute arbitrary SQL commands.OpenEMR, a widely used open-source electronic health records (EHR) and medical practice management application, is vulnerable to a blind SQL injection flaw (CVE-2026-33914) affecting versions prior to 8.0.0.3. The vulnerability resides within the PostCalendar module, specifically in the categoriesUpdate administrative function. The application fails to adequately sanitize the dels POST parameter, which is then directly incorporated into a raw SQL DELETE statement. This lack of sanitization allows a malicious actor to inject arbitrary SQL code, potentially leading to data breaches, system compromise, and unauthorized access to sensitive patient information. Organizations using vulnerable OpenEMR instances are at significant risk until they upgrade to version 8.0.0.3 or apply the necessary patches.

Attack Chain

1. Attacker identifies an OpenEMR instance running a version prior to 8.0.0.3.
2. Attacker crafts a malicious HTTP POST request targeting the /modules/PostCalendar/postcalendar.php endpoint.
3. The POST request includes the dels parameter containing a crafted SQL injection payload.
4. OpenEMR's pnVarCleanFromInput() function strips HTML tags from the dels parameter, but does not perform SQL escaping.
5. The unsanitized dels parameter is directly interpolated into a raw SQL DELETE statement.
6. Doctrine DBAL's executeStatement() executes the malicious SQL query against the OpenEMR database.
7. The attacker uses blind SQL injection techniques (e.g., time-based or boolean-based) to exfiltrate data or modify database records.
8. Successful exploitation leads to unauthorized access to patient data, modification of records, or complete database compromise.

Impact

Successful exploitation of this SQL injection vulnerability (CVE-2026-33914) can lead to severe consequences for healthcare providers and their patients. Potential impacts include unauthorized access to and exfiltration of sensitive patient data (PHI), modification or deletion of critical medical records, disruption of clinical operations, and potential regulatory fines for HIPAA violations. The number of affected OpenEMR installations is substantial, making this a widespread threat.

Recommendation

• Immediately upgrade OpenEMR installations to version 8.0.0.3 to patch CVE-2026-33914.
• Deploy the Sigma rule "Detect OpenEMR PostCalendar SQL Injection Attempt" to detect exploitation attempts targeting the vulnerable endpoint.
• Monitor web server logs for suspicious POST requests to /modules/PostCalendar/postcalendar.php containing unusual characters or SQL keywords in the dels parameter to detect potential exploitation attempts.

]]>highadvisoryopenemrsql-injectioncve-2026-33914web-application