CyberRota Analysis
AI-GeneratedOpenEMR versions prior to 8.3.0 are vulnerable to a reflected cross-site scripting flaw in the patient portal template import handler, where the templateHtml GET parameter is reflected in the page response without proper sanitization. This vulnerability allows attackers to craft malicious URLs that can execute arbitrary JavaScript in the browsers of authenticated users with Forms Administration permissions, potentially leading to session hijacking. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a URL that executes arbitrary JavaScript in the browser of any authenticated user with Forms Administration permissions who visits the link, enabling session hijacking.