OpenEMR versions prior to 8.0.0 are vulnerable to a stored cross-site scripting flaw that permits authenticated users to hijack sessions and escalate privileges to administrator.

This vulnerability is a stored cross-site scripting (CWE-79) issue located within the GAD-7 anxiety assessment form. It requires the attacker to be an authenticated user with at least clinician-level privileges to inject malicious scripts that execute in the context of other users.

The ability for a clinician to escalate privileges to an administrator poses a significant risk to the integrity and confidentiality of sensitive medical records. A successful exploit could result in unauthorized data access, the modification of patient health information, and full administrative compromise of the medical practice management system. The CVSS score of 8.7 reflects the high severity of this risk, particularly given the impact on confidentiality and integrity.

Immediate Action: Update OpenEMR to version 8.0.0 or later to apply the necessary input sanitization patches.

Proactive Monitoring: Audit access logs for unusual clinician activity or unauthorized administrative actions performed by low-privileged accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect input for malicious script tags, which may help block the injection of payloads into the GAD-7 form fields.

Public Exploit Available: No (exploit_available: unknown)

The vulnerability presents a high risk to clinical environments due to the potential for privilege escalation and unauthorized access to medical data. Administrators must prioritize the transition to version 8.0.0 immediately to eliminate the underlying injection vector. Failure to patch leaves the system open to session hijacking and administrative compromise by malicious or compromised internal accounts.