CVE-2021-25920 (published 2021-03-22T20:15Z)

In OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating a new user, which leads to a malicious user able to read and send sensitive messages on behalf of the victim user.

Severity: MEDIUM
CVSS v2 base score: 5.5 (AV:N/AC:L/Au:S/C:P/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-178
cwe_name: Improper Handling of Case Sensitivity
description: The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
extended_description: 
            Improperly handled case sensitive data can lead to several possible consequences, including:
               
                  case-insensitive passwords reducing the size of the key space, making brute force attacks easier
                  bypassing filters or access controls using alternate names
                  multiple interpretation errors using alternate names.
               
         
         

Fix information:
repo_url: https://github.com/openemr/openemr
commit_details: repo_url: https://github.com/openemr/openemr
author: Brady Miller
author_date: 2021-03-11 22:51:19-08:00
msg: bug fixes (#4280)
repository: repo_url: https://github.com/openemr/openemr
repo_name: openemr/openemr
description: The most popular open source electronic health records and medical practice management solution.
repo_language: PHP
owner: openemr
file_changes: filename: patient_match_dialog.php
change_type: ModificationType.MODIFY
diff: @@ -52,7 +52,7 @@ $form_DOB = $args['DOB'];
 
     function openPatient(ptid) {
         var f = opener.document.forms[0];
-        var ename = '<?php echo addslashes("select[$form_key]"); ?>';
+        var ename = <?php echo js_escape("select[$form_key]"); ?>;
         if (f[ename]) {
             f[ename].value = ptid;
             window.close();

programming_language: PHP
filename: patient_report.php
change_type: ModificationType.MODIFY
diff: @@ -329,7 +329,7 @@ $oemr_ui = new OemrUI($arrOeUiSettings);
                                                 echo attr($ierow['encounter']) . "/";
                                             }
 
-                                            echo "' />$disptitle</td>\n";
+                                            echo "' />" . text($disptitle) . "</td>\n";
                                             echo "     <td>" . text($prow['begdate']);
 
                                             if ($prow['enddate']) {

programming_language: PHP
filename: mfa_registrations.php
change_type: ModificationType.MODIFY
diff: @@ -136,7 +136,7 @@ $oemr_ui = new OemrUI($arrOeUiSettings);
                     <input type="hidden" name="csrf_token_form" value="<?php echo attr(CsrfUtils::collectCsrfToken()); ?>" />
                     <div>
                         <fieldset>
-                            <legend><?php echo xlt('Current Authentication Method for') . " " . $user_full_name; ?></legend>
+                            <legend><?php echo xlt('Current Authentication Method for') . " " . text($user_full_name); ?></legend>
                             <table class='table'>
                                 <tr>
                                   <th align='left'>&nbsp;<?php echo xlt('Method'); ?>&nbsp;</th>
@@ -165,7 +165,7 @@ $oemr_ui = new OemrUI($arrOeUiSettings);
                     </div>
                     <div>
                         <fieldset>
-                            <legend><?php echo xlt('Select/Add New Authentication Method for') . " " . $user_full_name; ?></legend>
+                            <legend><?php echo xlt('Select/Add New Authentication Method for') . " " . text($user_full_name); ?></legend>
                             <div class='col-sm-4 offset-sm-4'>
                                 <select name='form_add' onchange='addclick(this)'class='col-sm-12'>
                                     <option value=''><?php echo xlt('Add New...'); ?></option>

programming_language: PHP
filename: mfa_totp.php
change_type: ModificationType.MODIFY
diff: @@ -109,7 +109,7 @@ $user_full_name = $user_name['fname'] . " " . $user_name['lname'];
                             ?>
                             <div>
                                 <fieldset>
-                                    <legend><?php echo xlt('Provide Password for') . " " . $user_full_name; ?></legend>
+                                    <legend><?php echo xlt('Provide Password for') . " " . text($user_full_name); ?></legend>
                                     <div class="row">
                                         <div class="col-sm-12">
                                             <?php if ($error == "auth") { ?>
@@ -170,7 +170,7 @@ $user_full_name = $user_name['fname'] . " " . $user_name['lname'];
                             }
                             ?>
                             <fieldset>
-                                <legend><?php echo xlt('Register TOTP Key for') . " " . $user_full_name; ?></legend>
+                                <legend><?php echo xlt('Register TOTP Key for') . " " . text($user_full_name); ?></legend>
                                 <div class="row">
                                     <div class="col-sm-12">
                                         <?php if (!$doesExist) { ?>

programming_language: PHP
filename: mfa_u2f.php
change_type: ModificationType.MODIFY
diff: @@ -101,7 +101,7 @@ function docancel() {
         <div class="row">
             <div class="col-sm-12">
                 <fieldset>
-                    <legend><?php echo xlt('Register U2F Key for') . " " . $user_full_name; ?></legend>
+                    <legend><?php echo xlt('Register U2F Key for') . " " . text($user_full_name); ?></legend>
                     <div class='col-sm-12'>
                         <p><?php echo xlt("Instructions");?>:
                             <ul>

programming_language: PHP
filename: usergroup_admin.php
change_type: ModificationType.MODIFY
diff: @@ -277,12 +277,10 @@ if (isset($_POST["mode"])) {
         $calvar = (!empty($_POST["calendar"])) ? 1 : 0;
         $portalvar = (!empty($_POST["portal_user"])) ? 1 : 0;
 
-        $res = sqlStatement("select distinct username from users where username != ''");
+        $res = sqlQuery("select username from users where username = ?", [trim($_POST['rumple'])]);
         $doit = true;
-        while ($row = sqlFetchArray($res)) {
-            if ($doit == true && $row['username'] == trim($_POST['rumple'])) {
-                $doit = false;
-            }
+        if (!empty($res['username'])) {
+            $doit = false;
         }
 
         if ($doit == true) {

programming_language: PHP