OpenEMR 8.3.0 Vulnerability Patch: Auth Bypass, SQLi, IDOR, XSS Fixes

Vulnerability Overview Multiple security vulnerabilities exist in OpenEMR version 8.3.0, including authentication file read/write, SQL injection, authorization bypass, arbitrary file read, SQL execution, access control issues, object authorization issues, document controller issues, Cross-Site Scripting (XSS), CSRF protection bypass, database source data tree construction, sensitive form bypass, IDOR, missing ACL checks, missing authorization, path traversal, reflected cross-site scripting, BOLA, insecure direct object references, payment patient search AJAX leakage, document template download endpoint, QRDA Category VIII endpoint, patient data search, pre-authorization module, unauthorized redirect, username enumeration, and missing ACL/CSRF for Weno file download. Affected Scope PHP 8.3+ MariaDB 10.6+ MySQL 5.7+ Remediation 1. Authentication File Read/Write: Fix the authentication file read/write issue. 2. SQL Injection: Fix the SQL injection vulnerability. 3. Authorization Bypass: Fix the authorization bypass issue. 4. Arbitrary File Read: Fix the arbitrary file read vulnerability. 5. SQL Execution: Fix the SQL execution vulnerability. 6. Access Control Issues: Fix the access control issues. 7. Object Authorization Issues: Fix the object authorization issues. 8. Document Controller Issues: Fix the document controller issues. 9. Cross-Site Scripting (XSS): Fix the XSS vulnerability. 10. CSRF Protection Bypass: Fix the CSRF protection bypass issue. 11. Database Source Data Tree Construction: Fix the database source data tree construction issue. 12. Sensitive Form Bypass: Fix the sensitive form bypass issue. 13. IDOR: Fix the IDOR issue. 14. Missing ACL Checks: Fix the missing ACL checks issue. 15. Missing Authorization: Fix the missing authorization issue. 16. Path Traversal: Fix the path traversal issue. 17. Reflected Cross-Site Scripting: Fix the reflected cross-site scripting issue. 18. BOLA: Fix the BOLA issue. 19. Insecure Direct Object References: Fix the insecure direct object reference issue. 20. Payment Patient Search AJAX Leakage: Fix the payment patient search AJAX leakage issue. 21. Document Template Download Endpoint: Fix the document template download endpoint issue. 22. QRDA Category VIII Endpoint: Fix the QRDA Category VIII endpoint issue. 23. Patient Data Search: Fix the patient data search issue. 24. Pre-authorization Module: Fix the pre-authorization module issue. 25. Unauthorized Redirect: Fix the unauthorized redirect issue. 26. Username Enumeration: Fix the username enumeration issue. 27. Missing ACL/CSRF for Weno File Download: Fix the missing ACL/CSRF for Weno file download issue. POC Code or Exploit Code No specific POC code or exploit code is provided on the page. Summary Multiple security vulnerabilities exist in OpenEMR version 8.3.0, with a broad impact scope including authentication, authorization, SQL injection, file read/write, and cross-site scripting issues. It is recommended to apply the above remediation measures as soon as possible to ensure system security.

Goal Reached Thanks to every supporter — we hit 100%!

OpenEMR 8.3.0 Vulnerability Patch: Auth Bypass, SQLi, IDOR, XSS Fixes

More from this source