{"id":85984,"date":"2025-12-07T18:57:49","date_gmt":"2025-12-07T18:57:49","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-32794-stored-cross-site-scripting-vulnerability-in-openemr","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-32794-stored-cross-site-scripting-vulnerability-in-openemr\/","title":{"rendered":"CVE-2025-32794: Stored Cross-Site Scripting Vulnerability in OpenEMR<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The report discusses a stored cross-site scripting (XSS) vulnerability in OpenEMR, an open-source electronic health records and medical practice management application. The vulnerability, identified as CVE-2025-32794, affects versions prior to 7.0.3.4 and has a high impact due to its potential to compromise systems or leak sensitive data.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-32794
\nSeverity: High (CVSS: 7.6)
\nAttack Vector: Stored Cross-Site Scripting (XSS)
\nPrivileges Required: Low (Authenticated user with patient creation privileges)
\nUser Interaction: Required (Viewing the patient’s encounter under Orders \u2192 Procedure Orders)
\nImpact: Potential system compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

OpenEMR | Versions prior to 7.0.3.4<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit involves an authenticated user with patient creation privileges injecting arbitrary JavaScript code into the First and Last Name fields during patient registration. The stored XSS vulnerability is exploited when this malicious payload is executed as someone views the patient’s encounter under Orders \u2192 Procedure Orders.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

The following is a conceptual example of how an attacker might attempt to exploit this vulnerability:<\/p>\n

POST \/patient\/registration HTTP\/1.1\nHost: vulnerablehospital.example.com\nContent-Type: application\/json\n{\n\"first_name\": \"<script>\/*malicious JavaScript code*\/<\/script>\",\n\"last_name\": \"<script>\/*malicious JavaScript code*\/<\/script>\"\n}<\/code><\/pre>\n
Mitigation<\/strong><\/p>\n
Users are strongly advised to apply the vendor patch, which is included in version 7.0.3.4 of OpenEMR. In the interim, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can provide temporary mitigation.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The report discusses a stored cross-site scripting (XSS) vulnerability in OpenEMR, an open-source electronic health records and medical practice management application. The vulnerability, identified as CVE-2025-32794, affects versions prior to 7.0.3.4 and has a high impact due to its potential to compromise systems or leak sensitive data. Vulnerability Summary CVE ID: CVE-2025-32794 Severity: High […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-85984","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t