GHSA-ppg9-2f9f-chc4: OpenEMR before 8.5.0 Missing Authorization in FaxSMS utility.php Patient Creation
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the FaxSMS module's utility.php that allows read-only demographics users to create patient charts. Attackers can submit the formcreate request with chosen identity fields to create fictitious or duplicate patients with employer, history, and insurance records.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an account with read-only demographics access. The issue does not require user interaction, and the attack can be performed over the network.
What access does exploitation provide?
The attacker can create patient charts through the FaxSMS module's utility.php form_create request, despite having only read-only demographics permissions. They can choose identity fields and create fictitious or duplicate patients, including employer, history, and insurance records.
Which deployments are affected?
OpenEMR versions before 8.5.0 are affected. The provided information identifies the FaxSMS module as the vulnerable component.