Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/patient_file/pos_checkout_ippf.php performs state-changing void, voidall, and regen operations through GET requests without CSRF token validation. The form_checksum integrity check is conditional and is skipped when the parameter is omitted, allowing a cross-site request to force an authenticated billing user to void checkouts or regenerate invoice counters. The resulting changes can alter ledger state, financial reporting, and audit records. This issue is fixed in version 8.3.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-11-05T20:17:38.353Z",
  "pubdate": "2026-11-05T20:17:38.353Z",
  "executiveSummary": "A Cross-Site Request Forgery (CSRF) vulnerability exists in OpenEMR versions prior to 8.3.0, specifically within the billing checkout module.\nThe vulnerability allows an unauthenticated attacker to induce an authenticated user, typically a billing clerk or administrator, to perform unauthorized state-changing operations.\nBy coercing the victim's browser to execute malicious GET requests, an attacker can trigger void operations or regenerate invoice counters without the victim's consent.\nThis impacts the integrity of financial records and ledger states within the medical management system.\nThe flaw originates from the lack of CSRF token validation and the conditional nature of the form_checksum integrity check, which can be bypassed by omitting the parameter.\nExploitation requires the victim to have an active authenticated session and be tricked into visiting a malicious URI or resource under the attacker's control.\nThe risk implication is significant as it facilitates unauthorized modification of sensitive financial audit logs and operational billing data.",
  "technicalDetails": "The vulnerability resides in interface/patient_file/pos_checkout_ippf.php, which handles critical administrative functions related to point-of-sale (POS) checkout processes.\nThe root cause is a failure to enforce mandatory CSRF protection mechanisms. Specifically, the application implements a 'form_checksum' integrity verification; however, this mechanism is implemented conditionally. If an attacker omits the 'form_checksum' parameter entirely, the application skips the validation logic, thereby circumventing the intended security control.\nBecause the interface/patient_file/pos_checkout_ippf.php script accepts sensitive state-changing operations—namely 'void', 'voidall', and 'regen'—via HTTP GET requests, it is inherently susceptible to cross-site request forgery attacks.\nThe attack flow involves an attacker crafting a malicious payload, typically embedded within an <img> tag, a hidden <iframe>, or a redirect triggered by a social engineering campaign targeting an authenticated OpenEMR user.\nWhen the victim, whose session is currently active, renders the malicious content, the browser automatically attaches the user's session cookies to the request directed at the vulnerable endpoint.\nThe server processes the GET request as a legitimate instruction from the user because there is no anti-CSRF token (e.g., synchronizer token) to verify the origin of the request, and the optional form_checksum check is bypassed by omitting the parameter.\nUpon successful execution, the server processes the requested administrative operation—such as voiding checkout records or regenerating invoice sequences—directly modifying the backend database ledger.\nPost-exploitation, the attacker gains the ability to manipulate financial reporting, obfuscate billing audit trails, and interfere with revenue cycle management functions.\nThis vulnerability is present in all versions prior to 8.3.0. The lack of strict method enforcement (using GET for state-changing operations instead of POST) and the reliance on a flawed, conditional integrity check represent the primary technical failures leading to this security exposure."
}