OpenEMR Reflected Cross-Site Scripting Vulnerability in AJAX Script Interface

A reflected cross-site scripting vulnerability has been identified in OpenEMR versions prior to 7.0.3. The issue resides in the AJAX Script interface, specifically within the 'layout_listitems_ajax.php' file. The vulnerability is triggered by the 'target' parameter, which lacks proper input sanitization, allowing for the execution of malicious scripts in the user's browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser session.

Reproduction

To reproduce this vulnerability, send a GET request to 'interface/super/layout_listitems_ajax.php' with the 'target' parameter containing a crafted link, such as one using 'javascript:alert(document.cookie)'. This will trigger the XSS by executing the JavaScript in the user's browser.

Remediation

Users can update to OpenEMR version 7.0.3 or later, where this vulnerability has been patched.