hitoshura25/cvefixes huggingface dataset:
CVE-2021-25919 (PHP, published 2021-03-22T20:15Z)
Description: value: In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly. A highly privileged attacker could inject arbitrary code into input fields when creating a new user.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openemr/openemr
Files changed:
interface/orders/patient_match_dialog.php
interface/patient_file/report/patient_report.php
interface/usergroup/mfa_registrations.php
interface/usergroup/mfa_totp.php
interface/usergroup/mfa_u2f.php
interface/usergroup/usergroup_admin.php
Commit message: bug fixes (#4280)



Vulnerable code:
        var ename = '<?php echo addslashes("select[$form_key]"); ?>';
                                            echo "' />$disptitle</td>\n";
                            <legend><?php echo xlt('Current Authentication Method for') . " " . $user_full_name; ?></legend>
                            <legend><?php echo xlt('Select/Add New Authentication Method for') . " " . $user_full_name; ?></legend>
                                    <legend><?php echo xlt('Provide Password for') . " " . $user_full_name; ?></legend>
                                <legend><?php echo xlt('Register TOTP Key for') . " " . $user_full_name; ?></legend>
                    <legend><?php echo xlt('Register U2F Key for') . " " . $user_full_name; ?></legend>
        $res = sqlStatement("select distinct username from users where username != ''");
        while ($row = sqlFetchArray($res)) {
            if ($doit == true && $row['username'] == trim($_POST['rumple'])) {
                $doit = false;
            }

Fixed code:
        var ename = <?php echo js_escape("select[$form_key]"); ?>;
                                            echo "' />" . text($disptitle) . "</td>\n";
                            <legend><?php echo xlt('Current Authentication Method for') . " " . text($user_full_name); ?></legend>
                            <legend><?php echo xlt('Select/Add New Authentication Method for') . " " . text($user_full_name); ?></legend>
                                    <legend><?php echo xlt('Provide Password for') . " " . text($user_full_name); ?></legend>
                                <legend><?php echo xlt('Register TOTP Key for') . " " . text($user_full_name); ?></legend>
                    <legend><?php echo xlt('Register U2F Key for') . " " . text($user_full_name); ?></legend>
        $res = sqlQuery("select username from users where username = ?", [trim($_POST['rumple'])]);
        if (!empty($res['username'])) {
            $doit = false;
CVE-2021-25920 (PHP, published 2021-03-22T20:15Z)
Description: value: In OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating a new user, which leads to a malicious user able to read and send sensitive messages on behalf of the victim user.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-178 \u2014 Improper Handling of Case Sensitivity
The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
Repository: https://github.com/openemr/openemr
Files changed:
interface/orders/patient_match_dialog.php
interface/patient_file/report/patient_report.php
interface/usergroup/mfa_registrations.php
interface/usergroup/mfa_totp.php
interface/usergroup/mfa_u2f.php
interface/usergroup/usergroup_admin.php
Commit message: bug fixes (#4280)



Vulnerable code:
        var ename = '<?php echo addslashes("select[$form_key]"); ?>';
                                            echo "' />$disptitle</td>\n";
                            <legend><?php echo xlt('Current Authentication Method for') . " " . $user_full_name; ?></legend>
                            <legend><?php echo xlt('Select/Add New Authentication Method for') . " " . $user_full_name; ?></legend>
                                    <legend><?php echo xlt('Provide Password for') . " " . $user_full_name; ?></legend>
                                <legend><?php echo xlt('Register TOTP Key for') . " " . $user_full_name; ?></legend>
                    <legend><?php echo xlt('Register U2F Key for') . " " . $user_full_name; ?></legend>
        $res = sqlStatement("select distinct username from users where username != ''");
        while ($row = sqlFetchArray($res)) {
            if ($doit == true && $row['username'] == trim($_POST['rumple'])) {
                $doit = false;
            }

Fixed code:
        var ename = <?php echo js_escape("select[$form_key]"); ?>;
                                            echo "' />" . text($disptitle) . "</td>\n";
                            <legend><?php echo xlt('Current Authentication Method for') . " " . text($user_full_name); ?></legend>
                            <legend><?php echo xlt('Select/Add New Authentication Method for') . " " . text($user_full_name); ?></legend>
                                    <legend><?php echo xlt('Provide Password for') . " " . text($user_full_name); ?></legend>
                                <legend><?php echo xlt('Register TOTP Key for') . " " . text($user_full_name); ?></legend>
                    <legend><?php echo xlt('Register U2F Key for') . " " . text($user_full_name); ?></legend>
        $res = sqlQuery("select username from users where username = ?", [trim($_POST['rumple'])]);
        if (!empty($res['username'])) {
            $doit = false;
CVE-2021-25921 (PHP, published 2021-03-22T20:15Z)
Description: value: In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the `Allergies` section. An attacker could lure an admin to enter a malicious payload and by that initiate the exploit.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openemr/openemr
Files changed:
interface/orders/patient_match_dialog.php
interface/patient_file/report/patient_report.php
interface/usergroup/mfa_registrations.php
interface/usergroup/mfa_totp.php
interface/usergroup/mfa_u2f.php
interface/usergroup/usergroup_admin.php
Commit message: bug fixes (#4280)



Vulnerable code:
        var ename = '<?php echo addslashes("select[$form_key]"); ?>';
                                            echo "' />$disptitle</td>\n";
                            <legend><?php echo xlt('Current Authentication Method for') . " " . $user_full_name; ?></legend>
                            <legend><?php echo xlt('Select/Add New Authentication Method for') . " " . $user_full_name; ?></legend>
                                    <legend><?php echo xlt('Provide Password for') . " " . $user_full_name; ?></legend>
                                <legend><?php echo xlt('Register TOTP Key for') . " " . $user_full_name; ?></legend>
                    <legend><?php echo xlt('Register U2F Key for') . " " . $user_full_name; ?></legend>
        $res = sqlStatement("select distinct username from users where username != ''");
        while ($row = sqlFetchArray($res)) {
            if ($doit == true && $row['username'] == trim($_POST['rumple'])) {
                $doit = false;
            }

Fixed code:
        var ename = <?php echo js_escape("select[$form_key]"); ?>;
                                            echo "' />" . text($disptitle) . "</td>\n";
                            <legend><?php echo xlt('Current Authentication Method for') . " " . text($user_full_name); ?></legend>
                            <legend><?php echo xlt('Select/Add New Authentication Method for') . " " . text($user_full_name); ?></legend>
                                    <legend><?php echo xlt('Provide Password for') . " " . text($user_full_name); ?></legend>
                                <legend><?php echo xlt('Register TOTP Key for') . " " . text($user_full_name); ?></legend>
                    <legend><?php echo xlt('Register U2F Key for') . " " . text($user_full_name); ?></legend>
        $res = sqlQuery("select username from users where username = ?", [trim($_POST['rumple'])]);
        if (!empty($res['username'])) {
            $doit = false;
CVE-2021-25922 (PHP, published 2021-03-22T20:15Z)
Description: value: In OpenEMR, versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly. An attacker could trick a user to click on a malicious url and execute malicious code.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openemr/openemr
Files changed:
interface/orders/patient_match_dialog.php
interface/patient_file/report/patient_report.php
interface/usergroup/mfa_registrations.php
interface/usergroup/mfa_totp.php
interface/usergroup/mfa_u2f.php
interface/usergroup/usergroup_admin.php
Commit message: bug fixes (#4280)



Vulnerable code:
        var ename = '<?php echo addslashes("select[$form_key]"); ?>';
                                            echo "' />$disptitle</td>\n";
                            <legend><?php echo xlt('Current Authentication Method for') . " " . $user_full_name; ?></legend>
                            <legend><?php echo xlt('Select/Add New Authentication Method for') . " " . $user_full_name; ?></legend>
                                    <legend><?php echo xlt('Provide Password for') . " " . $user_full_name; ?></legend>
                                <legend><?php echo xlt('Register TOTP Key for') . " " . $user_full_name; ?></legend>
                    <legend><?php echo xlt('Register U2F Key for') . " " . $user_full_name; ?></legend>
        $res = sqlStatement("select distinct username from users where username != ''");
        while ($row = sqlFetchArray($res)) {
            if ($doit == true && $row['username'] == trim($_POST['rumple'])) {
                $doit = false;
            }

Fixed code:
        var ename = <?php echo js_escape("select[$form_key]"); ?>;
                                            echo "' />" . text($disptitle) . "</td>\n";
                            <legend><?php echo xlt('Current Authentication Method for') . " " . text($user_full_name); ?></legend>
                            <legend><?php echo xlt('Select/Add New Authentication Method for') . " " . text($user_full_name); ?></legend>
                                    <legend><?php echo xlt('Provide Password for') . " " . text($user_full_name); ?></legend>
                                <legend><?php echo xlt('Register TOTP Key for') . " " . text($user_full_name); ?></legend>
                    <legend><?php echo xlt('Register U2F Key for') . " " . text($user_full_name); ?></legend>
        $res = sqlQuery("select username from users where username = ?", [trim($_POST['rumple'])]);
        if (!empty($res['username'])) {
            $doit = false;
CVE-2022-2494 (JavaScript, published 2022-07-22T04:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openemr/openemr
Files changed:
portal/patient/scripts/app/patientdata.js
Commit message: bug fix d (#5368)



Vulnerable code:
                                '<a class="editval text-primary" onclick="page.toggleVal(this); return false;" data-tstate=new data-id="'+key+'">'+value+'</a>');

Fixed code:
                                '<a class="editval text-primary" onclick="page.toggleVal(this); return false;" data-tstate=new data-id="' + _.escape(key) + '">' + _.escape(value) + '</a>');
CVE-2023-2566 (PHP, published 2023-05-08T05:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openemr/openemr
Files changed:
library/htmlspecialchars.inc.php
Commit message: fixes


Vulnerable code:
 * Special function to remove the 'javascript' string (case insensitive) for when including a variable within a html link
function javascriptStringRemove($text)
    return str_ireplace('javascript', '', $text ?? '');

Fixed code:
 * Special function to remove the 'javascript' strings (case insensitive) for when including a variable within a html link
function javascriptStringRemove(?string $text): string
    $returnText = str_ireplace('javascript', '', $text ?? '');

    if (javascriptStringCheck($returnText)) {
        $returnText = javascriptStringRemove($returnText);
    }

    return $returnText;
}

/**
 * Special function to check if 'javascript' string (case insensitive) is in a variable within a html link
 */
function javascriptStringCheck(?string $text): bool
{
    if (stripos($text ?? '', 'javascript') === false) {
        return false;
    } else {
        return true;
    }
CVE-2023-2674 (PHP, published 2023-05-12T08:15Z)
Description: value: Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/openemr/openemr
Files changed:
library/classes/Controller.class.php
Commit message: bug fix (#6098)



Vulnerable code:

Fixed code:
use OpenEMR\Common\Acl\AclMain;
use OpenEMR\Common\Twig\TwigContainer;

        if ((array_key_first($qarray) ?? '') == 'practice_settings') {
            if (!AclMain::aclCheckCore('admin', 'practice')) {
                echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Practice Settings")]);
                exit;
            }
        }
CVE-2023-2944 (PHP, published 2023-05-27T22:15Z)
Description: value: Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/openemr/openemr
Files changed:
interface/usergroup/addrbook_edit.php
Commit message: bug fix (#6267)



Vulnerable code:
        <?php echo generate_select_list('form_state', 'state', ($row['state'] ?? null), '', 'Unassigned', 'form-control-sm', 'typeSelect(this.value)'); ?> 
    <?php echo generate_select_list('form_state2', 'state', ($row['state2'] ?? null), '', 'Unassigned', 'form-control-sm', 'typeSelect(this.value)'); ?> 

Fixed code:
use OpenEMR\Common\Twig\TwigContainer;
if (!AclMain::aclCheckCore('admin', 'practice')) {
    echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Address Book")]);
    exit;
}

        <?php echo generate_select_list('form_state', 'state', ($row['state'] ?? null), '', 'Unassigned', 'form-control-sm', 'typeSelect(this.value)'); ?>
    <?php echo generate_select_list('form_state2', 'state', ($row['state2'] ?? null), '', 'Unassigned', 'form-control-sm', 'typeSelect(this.value)'); ?>
CVE-2023-2945 (PHP, published 2023-05-27T22:15Z)
Description: value: Missing Authorization in GitHub repository openemr/openemr prior to 7.0.1.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/openemr/openemr
Files changed:
portal/messaging/handle_note.php
Commit message: fix: bug fix (#6270)



Vulnerable code:

Fixed code:

    // ensure the owner is bootstrapped to the $_POST['sender_id'] and
    //   $_POST['sender_name'], if applicable
    if (empty($_POST['sender_id']) && !empty($_POST['sender_name'])) {
        echo xlt("illegal Action");
        OpenEMR\Common\Session\SessionUtil::portalSessionCookieDestroy();
        exit;
    }
    if (!empty($_POST['sender_id'])) {
        if ($_POST['sender_id'] != $owner) {
            echo xlt("illegal Action");
            OpenEMR\Common\Session\SessionUtil::portalSessionCookieDestroy();
            exit;
        }
    }
    if (!empty($_POST['sender_name'])) {
        $nameCheck = sqlQuery("SELECT `fname`, `lname` FROM `patient_data` WHERE `pid` = ?", [$_SESSION['pid']]);
        if (empty($nameCheck) || ($_POST['sender_name'] != ($nameCheck['fname'] . " " . $nameCheck['lname']))) {
            echo xlt("illegal Action");
            OpenEMR\Common\Session\SessionUtil::portalSessionCookieDestroy();
            exit;
        }
    }
CVE-2023-2946 (PHP, published 2023-05-27T23:15Z)
Description: value: Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/openemr/openemr
Files changed:
library/classes/Controller.class.php
Commit message: fix: bug (#6284)



Vulnerable code:

Fixed code:
        if ((array_key_first($qarray) ?? '') == 'prescription') {
            if (!AclMain::aclCheckCore('patients', 'prescriptions')) {
                echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Prescriptions")]);
                exit;
            }
        }
CVE-2023-2948 (PHP, published 2023-05-28T04:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/openemr/openemr
Files changed:
interface/forms/eye_mag/js/eye_base.php
interface/main/finder/dynamic_finder.php
interface/main/finder/dynamic_finder_ajax.php
library/custom_template/share_template.php
Commit message: fixes: couple more misc fixes (#6336)



Vulnerable code:
        'from_id'           : <?php echo js_escape($providerID); ?>,
        let serverUrl = "dynamic_finder_ajax.php?csrf_token_form=" + <?php echo js_url(CsrfUtils::collectCsrfToken()); ?>;
            serverUrl += "&search_any=" + srcAny;
// Not checking csrf for good reasons.
//  1. Not needed since no state changes in this script
//  2. It will cause potential session clash fails because it throws a popup which messes things up
//     when opening a patient in a new window.
                     list_id: <?php echo htmlspecialchars($list_id, ENT_QUOTES);?>,
                    alert("<?php echo addslashes(xl('You should select at least one Provider'));?>");
                                echo "<option value='" . htmlspecialchars($row['id'], ENT_QUOTES) . "' $sel>" . htmlspecialchars($row['lname'] . "," . $row['fname'], ENT_QUOTES) . "</option>";
                    <a href="#" onclick="add_template()" class="btn btn-primary"><span><?php echo htmlspecialchars(xl('Save'), ENT_QUOTES);?></span></a>

Fixed code:
        'from_id'           : <?php echo attr_js($providerID); ?>,
        let serverUrl = "dynamic_finder_ajax.php";
            serverUrl += "?search_any=" + srcAny;
// Not checking csrf since it breaks when opening up a patient in a new frame.
//  Also note that csrf checking is not needed in this script because of following 2 reasons.
//  1. cookie_samesite in OpenEMR is set to 'Strict', which is an effective security measure to stop csrf vulnerabilities.
//  2. Additionally, in this script there are no state changes, thus it is not even sensitive to csrf vulnerabilities.
                     list_id: <?php echo js_escape($list_id); ?>,
                    alert(<?php echo xlj('You should select at least one Provider');?>);
                                echo "<option value='" . attr($row['id']) . "' $sel>" . text($row['lname'] . "," . $row['fname']) . "</option>";
                    <a href="#" onclick="add_template()" class="btn btn-primary"><span><?php echo xlt('Save');?></span></a>