A stored cross-site scripting vulnerability in OpenEMR allows authenticated attackers to execute arbitrary JavaScript within the browser sessions of other users.

The application fails to properly sanitize input within the Eye Exam form functionality. This allows an authenticated attacker possessing the Notes - my encounters role to inject malicious scripts that execute in the context of other users who view the affected patient encounter pages or visit history.

This vulnerability poses a significant risk to the integrity and confidentiality of medical records within OpenEMR. With a CVSS score of 8.7, the flaw enables attackers to perform actions on behalf of other users, potentially leading to unauthorized data modification, account takeover, or the exfiltration of sensitive patient health information.

Immediate Action: Upgrade your OpenEMR installation to version 8.0.0.3 or later to apply the necessary security patches.

Proactive Monitoring: Review application access logs for unusual activity associated with user accounts holding the Notes - my encounters role, and monitor for suspicious script execution patterns.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter malicious payloads from input fields.

Public Exploit Available: Unknown

Given the High severity and the sensitivity of medical data processed by OpenEMR, organizations must prioritize the update to version 8.0.0.3. Administrators should audit user permissions to ensure the principle of least privilege is enforced, limiting the potential impact of similar vulnerabilities until the patch is successfully applied.