OpenMRS Reflected Cross-Site Scripting Vulnerability in Quick Report Servlet

A reflected cross-site scripting vulnerability has been identified in OpenMRS version 2.4.3 Build 0ff0ed. The issue arises in the /legacyui/quickReportServlet component, where attackers can execute arbitrary JavaScript in the context of the user's browser. This is achieved by injecting a crafted payload into the reportType parameter.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, authenticate as a user with access to view quick reports, such as an admin. Then, navigate to the quick report servlet endpoint and inject a script payload into the reportType parameter. The injected script will be executed, demonstrating the cross-site scripting vulnerability.