OpenEMR Reflected Cross-Site Scripting Vulnerability in ajax_download.php

A reflected cross-site scripting vulnerability has been identified in OpenEMR versions prior to 8.0.0.3. The issue arises in the 'custom/ajax_download.php' file, where the 'reportID' parameter is processed and echoed without proper sanitization. This flaw allows authenticated attackers to inject arbitrary JavaScript that is executed in the context of the victim's browser session.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute arbitrary JavaScript in the victim's browser session.

Reproduction

To reproduce this vulnerability, an authenticated user can send a POST request to the 'ajax_download.php' endpoint with a crafted 'reportID' parameter. The injected JavaScript will be executed in the browser of the user who receives the crafted form submission.

Remediation

Users can upgrade to OpenEMR version 8.0.0.3 or later to address this vulnerability.