Description

openemr has a feature to customize the “User Manual Link Override” , due to a bad sanitization it allows to put javascript:// scheme which allows to execute javascript code.

Proof of Concept

1. login with admin
2. go on Global Settings - Branding
3. Edit User Manual Link Override Field
4. insert the payload
5. logout with admin
6. login as any user and go on “About OpenEMR”
7. Click User Manual Button

PAYLOAD:  javascript:alert(document.cookie)

Video PoC