Description

The admin panel (admin.php) does not properly sanitize the text in the “Site Name” field, allowing a user with admin access to inject arbitrary HTML.

This is in a similar vein to CVE-2022-4733 but still exists as of version 7.0.1-dev.

Proof of Concept

1. Log in as a user with admin permissions
2. Navigate to Admin->Config at the top
3. Go to the “Branding” tab on the side
4. In the “Application Title” field, enter:

<script>alert(document.cookie);</script>

5. Click “Save”
6. Go to <OpenEMR domain>/admin.php
7. An alert will be shown