OpenEMR Secure Messaging Link Handling Vulnerability Allowing Phishing

A vulnerability in OpenEMR prior to version 7.0.4 allows links sent via Secure Messaging to be opened within the OpenEMR/Portal site. This behavior can be exploited for phishing attacks. The issue has been patched in version 7.0.4.

Impact

Exploitation of this vulnerability could lead to successful phishing attempts, as it allows malicious links to be opened within the context of the OpenEMR application.

Reproduction

The vulnerability can be reproduced by sending a link through the Secure Messaging feature in OpenEMR version 7.0.3. When the link is clicked, it opens within the OpenEMR application instead of an external browser, potentially leading to a phishing scenario.

Remediation

Users can upgrade to OpenEMR version 7.0.4 to address this vulnerability.