Description

Hi there,

Someone submitted an xss vulnerability about your project before.And please see “https://huntr.dev/bounties/f353adfb-e5b8-43e7-957a-894670fd4ccd/” for details.You submitted a fix in 7.0.0.2 with commit 4565d8.But after my tests, I found that it was still unsafe.
The following is the code you used.

str_ireplace('javascript', '', $text ?? '');

We can bypass it by inserting an additional ‘javascript’.

Video link

video link

https://drive.google.com/file/d/142SE1G7F6cHfc_TZRT7XzJCLu0Y2_887/view?usp=share_link

#Steps

1. Login with admin
2. Go on Admin - config - Branding
3. Edit User Manual Link Override Field
   4.Insert the following payload

javjavascriptascript:alert(document.cookie)

5.Logout with admin

6.Login as any user and go on “About OpenEMR”

7.Click User Manual Button

Proof of Concept

javjavascriptascript:alert(document.cookie)