GHSA-c997-5w2m-grrf: OpenEMR before 8.5.0 Stored XSS via Printed Fee Sheet Appointment Comments
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in printedfeesheet.php that allows authenticated portal patients to inject script by setting unescaped appointment comments (pchometext). Attackers can submit HTML payloads via the formcomments field in addediteventuser.php that execute when staff open the patient's fee sheet, acting within the staff session.
Frequently Asked Questions
Who can exploit this vulnerability, and what interaction is required?
An authenticated OpenEMR portal patient can submit a malicious HTML payload in appointment comments through the form_comments field. The payload executes only when a staff member opens that patient's printed fee sheet.
Which OpenEMR versions are affected?
OpenEMR versions before 8.5.0 are affected. The provided information identifies 8.5.0 as the version boundary but does not specify affected release ranges beyond versions earlier than it.
What is the impact when the payload executes?
The injected script runs in the staff member's session when they view the fee sheet. This can allow actions or access consistent with that staff session.