Description
OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamic_finder_ajax.php that allows authenticated users without patients/demo permission to query patient demographics. Attackers can supply arbitrary patient_data columns via the sColumns parameter to enumerate names, dates of birth, contact details, and Social Security numbers across the practice.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openemr | openemr | < 8.5.0 | 8.5.0 |
References
- GitHub Security Advisory (GHSA-79g8-hm7q-xrh4) vendor-advisory
- VulnCheck Advisory: OpenEMR before 8.5.0 Missing Authorization via dynamic_finder_ajax.php Patient Finder third-party-advisory