CVE-2023-2943 (PHP, published 2023-05-27T22:15Z)
Description: value: Code Injection in GitHub repository openemr/openemr prior to 7.0.1.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/openemr/openemr
Files changed:
library/pnotes.inc.php
portal/add_edit_event_user.php
portal/find_appt_popup_user.php
portal/messaging/secure_chat.php
src/PatientPortal/Chat/ChatController.php
Commit message: bug fix (#6079)

* bug fix

* better fix and remove prefix underscore private visibility

* better fix

* even better fix

* revert

* jsAttr()

* another fix

* another fix

* use |=

* review fixes

* typo

* remove whitespace

Vulnerable code:
        array($datetime, $body, $pid, $user, $_SESSION['authProvider'], $authorized, $activity, $title, $assigned_to, $message_status, $_SESSION['authUserID'])
use OpenEMR\Core\Header;
    if ($_POST['form_allday']) {
    if ($_POST['form_repeat']) {
    if ($_POST['form_repeat_type'] == 5) {
    } elseif ($_POST['form_repeat_type'] == 6) {
    } elseif ($_POST['form_repeat_type'] == 7) {
    } elseif ($_POST['form_repeat_type'] == 8) {
    } elseif ($_POST['form_repeat_type'] == 9) {
                        "'" . add_escape_custom($_POST['form_pid']) . "', " .
                    "pc_pid = '" . add_escape_custom($_POST['form_pid']) . "', " .
                "pc_pid = '" . add_escape_custom($_POST['form_pid']) . "', " .
                "pc_endDate = '" . add_escape_custom(fixDate($_POST['form_enddate'])) . "', " .
                "pc_recurrtype = '" . ($_POST['form_repeat'] ? '1' : '0') . "', " .
                "pc_alldayevent = '" . add_escape_custom($_POST['form_allday']) . "', " .
                "pc_prefcatid = '" . add_escape_custom($_POST['form_prefcat']) . "', " .
                "pc_facility = '" . (int)$_POST['facility'] . "' " . // FF stuff
                    "'" . add_escape_custom($_POST['form_pid']) . "', " .
                "'" . add_escape_custom($_POST['form_pid']) . "', " .
                "'" . add_escape_custom(fixDate($_POST['form_enddate'])) . "', " .
                "'" . ($_POST['form_repeat'] ? '1' : '0') . "', " .
                "'" . add_escape_custom($_POST['form_allday']) . "', " .
                "'" . add_escape_custom($_POST['form_prefcat']) . "', " .
                "1, " . (int)$_POST['facility'] . ")"); // FF stuff
    $rtn = addPnote($_POST['form_pid'], $note, 1, 1, $title, $user['username'], '', 'New');
                <input type='hidden' name='form_title' id='form_title' value='<?php echo $row['pc_catid'] ? attr($row['pc_title']) : xla("Office Visit"); ?>' />
                <input type='hidden' name='form_apptstatus' id='form_apptstatus' value='<?php echo $row['pc_apptstatus'] ? attr($row['pc_apptstatus']) : "^" ?>' />
                        <select class="form-control mb-1" onchange='set_category()' id='form_category' name='form_category' value='<?php echo ($row['pc_catid'] > "") ? attr($row['pc_catid']) : '5'; ?>'>
                            <input class="form-control" type='text' size='1' id='form_duration' name='form_duration' value='<?php echo $row['pc_duration'] ? ($row['pc_duration'] * 1 / 60) : attr($thisduration) ?>' readonly />
                    <?php if ($_GET['eid'] && $row['pc_apptstatus'] !== 'x') { ?>
                if ($prefcatid == $input_catid || !$prefcatid) {
                    $slots[$i] |= 1;
                    $slots[$i] |= 2;
if ($_REQUEST['searchdays']) {
                return html;
        if ($this->_isAdmin($username)) {
            $this->_parseAdminCommand($message);
    private function _isAdmin($username)
    private function _parseAdminCommand($message)
    private function _getMyUniqueHash()
        $hash = $this->_getMyUniqueHash();

Fixed code:
        array($datetime, $body, $pid, $user, ($_SESSION['authProvider'] ?? null), $authorized, $activity, $title, $assigned_to, $message_status, ($_SESSION['authUserID'] ?? null))
use OpenEMR\Services\AppointmentService;
if (!empty($_POST['form_pid'])) {
    if ($_POST['form_pid'] != $_SESSION['pid']) {
        echo js_escape("error");
        exit();
    }

    if (! getAvailableSlots($_POST['form_date'], date('Y-m-d', strtotime("+1 year " . $_POST['form_date'])), $_POST['form_provider_ae'])) {
        echo js_escape("error");
        exit();
    }

    $appointment_service = (new AppointmentService())->getOneCalendarCategory($_POST['form_category']);
    if (($_POST['form_duration'] * 60) != ($appointment_service[0]['pc_duration'])) {
        echo js_escape("error");
        exit();
    }
}

    if ($_POST['form_allday'] ?? null) {
    if ($_POST['form_repeat'] ?? null) {
    if (($_POST['form_repeat_type'] ?? null) == 5) {
    } elseif (($_POST['form_repeat_type'] ?? null) == 6) {
    } elseif (($_POST['form_repeat_type'] ?? null) == 7) {
    } elseif (($_POST['form_repeat_type'] ?? null) == 8) {
    } elseif (($_POST['form_repeat_type'] ?? null) == 9) {
                        "'" . add_escape_custom($_SESSION['pid']) . "', " .
                    "pc_pid = '" . add_escape_custom($_SESSION['pid']) . "', " .
                "pc_pid = '" . add_escape_custom($_SESSION['pid']) . "', " .
                "pc_endDate = '" . add_escape_custom(fixDate($_POST['form_enddate'] ?? '')) . "', " .
                "pc_recurrtype = '" . (($_POST['form_repeat'] ?? null) ? '1' : '0') . "', " .
                "pc_alldayevent = '" . add_escape_custom(($_POST['form_allday'] ?? '')) . "', " .
                "pc_prefcatid = '" . add_escape_custom(($_POST['form_prefcat'] ?? '')) . "', " .
                "pc_facility = '" . (int)($_POST['facility'] ?? null) . "' " . // FF stuff
                    "'" . add_escape_custom($_SESSION['pid']) . "', " .
                "'" . add_escape_custom($_SESSION['pid']) . "', " .
                "'" . add_escape_custom(fixDate(($_POST['form_enddate'] ?? ''))) . "', " .
                "'" . (($_POST['form_repeat'] ?? null) ? '1' : '0') . "', " .
                "'" . add_escape_custom(($_POST['form_allday'] ?? '')) . "', " .
                "'" . add_escape_custom(($_POST['form_prefcat'] ?? null)) . "', " .
                "1, " . (int)($_POST['facility'] ?? null) . ")"); // FF stuff
    $rtn = addPnote($_SESSION['pid'], $note, 1, 1, $title, $user['username'], '', 'New');
                <input type='hidden' name='form_title' id='form_title' value='<?php echo ($row['pc_catid'] ?? '') ? attr($row['pc_title']) : xla("Office Visit"); ?>' />
                <input type='hidden' name='form_apptstatus' id='form_apptstatus' value='<?php echo ($row['pc_apptstatus'] ?? '') ? attr($row['pc_apptstatus'] ?? '') : "^" ?>' />
                        <select class="form-control mb-1" onchange='set_category()' id='form_category' name='form_category' value='<?php echo (($row['pc_catid'] ?? '') > "") ? attr($row['pc_catid']) : '5'; ?>'>
                            <input class="form-control" type='text' size='1' id='form_duration' name='form_duration' value='<?php echo ($row['pc_duration'] ?? '') ? ($row['pc_duration'] * 1 / 60) : attr($thisduration) ?>' readonly />
                    <?php if (($_GET['eid'] ?? null) && $row['pc_apptstatus'] !== 'x') { ?>
                if (!empty($slots[$i])) {
                    if ($prefcatid == $input_catid || !$prefcatid) {
                        $slots[$i] |= 1;
                    } else {
                        $slots[$i] |= 2;
                    }
                    $slots[$i] |= 1;
if ($_REQUEST['searchdays'] ?? null) {
                return jsAttr(html);
        if ($this->isAdmin($username)) {
            $this->parseAdminCommand($message);
    private function isAdmin($username)
    private function parseAdminCommand($message)
    private function getMyUniqueHash()
        $hash = $this->getMyUniqueHash();