Description
OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the request-supplied form_pid (or the patient_id_cc value in Sphere data) to onsite_portal_activity without checking it against the session patient. Authenticated portal patients can submit portal-save, review-save, AuthorizeNet, Stripe, or Sphere requests to insert or modify forged payment-audit records in other patients' billing records.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openemr | openemr | < 8.3.0 | 8.3.0 |
References
- GitHub Security Advisory (GHSA-c9wg-vrr9-65wj) vendor-advisory
- VulnCheck Advisory: OpenEMR before 8.3.0 IDOR via form_pid in portal/lib/paylib.php third-party-advisory