Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/payment_ajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patient_data. Any authenticated user, including a non-clinical role, can enumerate patient identifiers, full names, and dates of birth through the set_patient branch. This issue is fixed in version 8.3.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-05T20:17:38.980Z",
  "pubdate": "2026-11-05T20:17:38.980Z",
  "executiveSummary": "OpenEMR versions prior to 8.3.0 contain a critical authorization flaw within the library/ajax/payment_ajax.php script. The vulnerability involves a lack of Access Control List (ACL) enforcement during patient data retrieval requests.\nAlthough the endpoint implements Cross-Site Request Forgery (CSRF) protection, it fails to verify if the authenticated user possesses the appropriate authorization levels to access sensitive patient information. This oversight allows any authenticated user, regardless of their clinical or administrative role, to perform unauthorized wildcard searches.\nThe impact is significant, as it facilitates the mass enumeration of Personally Identifiable Information (PII) and Protected Health Information (PHI), including patient identifiers, full legal names, and dates of birth.\nThe risk is high given that the system is designed for healthcare environments where strict data segregation and access controls are mandatory. An attacker, having attained valid user credentials, can exploit this flaw to perform automated data scraping, leading to potential large-scale data breaches and privacy violations. Remediation requires updating to version 8.3.0 or later to ensure proper ACL validation is integrated into the payment_ajax.php workflow.",
  "technicalDetails": "The root cause of this vulnerability is an authorization bypass in the server-side processing logic within library/ajax/payment_ajax.php. While the script correctly handles CSRF token validation to prevent cross-site request attacks, it fails to invoke the AclMain authorization check before executing backend database queries.\nThe vulnerability manifests in the 'set_patient' branch of the script. This branch is intended to facilitate AJAX-driven patient lookups, but because it omits role-based access verification, any user session authenticated within the application is implicitly trusted by the backend. Consequently, the application processes wildcard search queries against the patient_data table without verifying if the requesting user's session role is permitted to access patient demographics.\nThe attack flow follows a predictable pattern: 1) The attacker authenticates to the OpenEMR instance as a low-privileged user (e.g., a standard staff member or non-clinical role). 2) The attacker captures a valid session and retrieves a legitimate CSRF token generated by the application. 3) The attacker submits a malicious POST or GET request targeting library/ajax/payment_ajax.php, setting the branch parameter to 'set_patient'. 4) The attacker includes a wildcard search string (e.g., '*') within the request parameters. 5) The server validates the CSRF token and immediately executes a database query that returns a list of all patients stored in the system.\nBecause the application does not enforce granular access control, the response from the server returns comprehensive records. This results in the leakage of sensitive data, including unique patient identifiers, full names, and dates of birth. The exposure occurs directly via the standard HTTP response, which is typically returned in JSON or formatted text, making it trivial for an attacker to parse the information systematically.\nThe vulnerability is restricted to versions prior to 8.3.0. Exploitation requires authenticated access, but because it does not require administrative or clinical-level privileges, the attack surface includes all valid user accounts within the environment. There are no specialized network requirements, as the vulnerability is inherent to the application code and accessible from any internal or external node that can reach the web server."
}