Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege Escalation
Vulnerability Description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a stored cross-site scripting vulnerability in the GAD-7 anxiety assessment form allows authenticated users with clinician privileges to inject malicious JavaScript that executes when other users view the form. This enables session hijacking, account takeover, and privilege escalation from clinician to administrator. Version 8.0.0 fixes the issue.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
OpenEMR 跨站脚本漏洞
Vulnerability Description
OpenEMR是OpenEMR社区的一套开源的医疗管理系统。该系统可用于医疗实践管理、电子医疗记录、处方书写和医疗帐单申请。 OpenEMR 8.0.0之前版本存在跨站脚本漏洞，该漏洞源于GAD-7焦虑评估表单存在存储型跨站脚本，可能导致具有临床医生权限的认证用户注入恶意JavaScript，进而在其他用户查看表单时执行，实现会话劫持、账户接管和从临床医生到管理员的权限提升。
CVSS Information
N/A
Vulnerability Type
N/A