CVE-2026-124463

Summary

OpenEMR before 8.3.0 has a stored XSS flaw where authenticated users with CAMOS access can inject malicious HTML via ajax_save.php, which later executes unencoded when printed through rx_print.php's non-print_html branch. This allows attackers to hijack victim sessions and perform unauthorized actions within the application.

Exploitability

Exploitation requires valid low-privileged credentials and user interaction (e.g., a victim viewing or printing the malicious CAMOS entry), making it moderately difficult but feasible for insider threats or compromised accounts.

Blast radius

Successful exploitation could lead to full session hijacking, unauthorized data access, or privilege escalation within the OpenEMR environment, potentially affecting all users who view the compromised entry.

Detection

Defenders should monitor for anomalous HTML/JavaScript sequences in CAMOS-related database entries or logs of ajax_save.php requests followed by unusual patterns in rx_print.php access (e.g., non-print_html branch usage with encoded script payloads). No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to OpenEMR version 8.3.0 or later, which patches the stored XSS vulnerability in CAMOS content handling.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.