GHSA-r65f-fxf6-4fwr: OpenEMR before 8.5.0 Missing Authorization via diagnosis_full.php Billing Operations
OpenEMR before 8.5.0 contains a missing authorization vulnerability in diagnosisfull.php that allows authenticated users to delete or clear any billing record by ID. Attackers can supply a target billing ID in the id parameter with delete or clear mode to deactivate other patients' charges and corrupt financial records.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated OpenEMR user may be able to exploit it. The attacker needs to know or supply the ID of a target billing record and does not require user interaction.
What actions can an attacker perform?
An attacker can send requests to diagnosis_full.php using a target billing ID with delete or clear mode. This can deactivate charges belonging to other patients and corrupt financial records.
Are installations running the fixed release affected?
The issue affects OpenEMR versions before 8.5.0. OpenEMR 8.5.0 is identified as the first non-affected version in the provided information.