CVE-2025-29772: OpenEMR CAMOS Reflected XSS Vulnerability

CVE-2025-29772 Overview

CVE-2025-29772 is a reflected cross-site scripting (XSS) vulnerability in OpenEMR, an open-source electronic health records and medical practice management application. The flaw exists in the CAMOS module's new.php script, where the hidden_subcategory POST parameter is written to the page without proper output encoding. An authenticated attacker who can lure a logged-in user into submitting a crafted request can execute arbitrary JavaScript in that user's browser session. The issue is tracked as [CWE-79] and is fixed in OpenEMR 7.0.3.

Critical Impact
Successful exploitation lets attackers execute JavaScript in the context of an authenticated OpenEMR user, enabling session theft, account takeover, and unauthorized access to protected health information.

Affected Products

OpenEMR versions prior to 7.0.3
Component: interface/forms/CAMOS/new.php
Deployments exposing the CAMOS form to authenticated clinicians or staff

Discovery Timeline

2025-03-31 - CVE-2025-29772 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29772

Vulnerability Analysis

The vulnerability resides in the CAMOS (Computer-Assisted Medical Ordering System) form handler at interface/forms/CAMOS/new.php. The template embeds two user-controlled values, $temp_preselect_mode and $preselect_category, into an inline JavaScript call to select_word(). The original code used fixquotes(), which escapes quote characters for HTML contexts but does not neutralize JavaScript string delimiters or control characters. When the POST parameter hidden_subcategory reaches this render path, attacker-controlled input breaks out of the JavaScript string literal and executes in the browser of the authenticated user rendering the page.

Root Cause

The root cause is missing context-aware output encoding. fixquotes() is designed for HTML attribute escaping, not for embedding untrusted data inside a JavaScript expression. Concatenating tainted strings directly into a <script> block places the input in a JavaScript execution context where any unescaped quote, backslash, or newline can terminate the string and inject code.

Attack Vector

Exploitation requires an authenticated OpenEMR session and user interaction, typically a victim submitting or loading a crafted CAMOS form request. The attacker crafts a POST body containing a malicious hidden_subcategory value and delivers it via a phishing link, malicious page, or forged form. When the response renders, the injected script runs with the victim's session cookies and can perform actions on their behalf, including reading patient records.

php

// Patch from interface/forms/CAMOS/new.php
// Before (vulnerable): fixquotes() only escapes HTML quotes
-  if (select_word("<?php echo fixquotes($temp_preselect_mode) . "\", \"" . fixquotes($preselect_category); ?>" ,f2.select_category)) {

// After (fixed): js_escape() safely encodes values for a JavaScript context
+  if (select_word(<?php echo js_escape($temp_preselect_mode) . ", " . js_escape($preselect_category); ?> ,f2.select_category)) {
     click_category();
   }

Source: OpenEMR commit 17c5c42

Detection Methods for CVE-2025-29772

Indicators of Compromise

POST requests to interface/forms/CAMOS/new.php containing script tags, event handlers, or JavaScript escape sequences in the hidden_subcategory parameter
Responses from the CAMOS form containing reflected values with <script>, onerror=, or javascript: payloads
Unusual outbound requests from authenticated user browsers immediately after loading a CAMOS form
Session token exfiltration attempts originating from OpenEMR client sessions

Detection Strategies

Deploy web application firewall rules that inspect POST bodies to CAMOS endpoints for XSS payload patterns
Log and alert on OpenEMR HTTP responses where request parameters are reflected verbatim into JavaScript contexts
Baseline normal hidden_subcategory values, which are internal category identifiers, and alert on values containing punctuation used in scripting

Monitoring Recommendations

Enable OpenEMR access logging and forward web server logs to a centralized analytics platform for query and correlation
Monitor authenticated user sessions for anomalous API calls following CAMOS form interactions
Track browser Content Security Policy (CSP) violation reports to surface reflected script execution attempts

How to Mitigate CVE-2025-29772

Immediate Actions Required

Upgrade OpenEMR to version 7.0.3 or later, which replaces fixquotes() with js_escape() in the CAMOS template
Restrict access to the OpenEMR web interface to trusted networks or VPN clients until patching is complete
Force session invalidation for all users after upgrading to clear any potentially hijacked sessions

Patch Information

The fix is delivered in commit 17c5c42 and documented in GitHub Security Advisory GHSA-89gp-g4c9-hv8h. The patch replaces HTML-oriented quoting with JavaScript-context escaping via js_escape(), neutralizing the injection point in interface/forms/CAMOS/new.php.

Workarounds

Deploy a strict Content Security Policy that blocks inline script execution outside a defined nonce or hash allowlist
Configure a WAF rule to reject requests to interface/forms/CAMOS/new.php where hidden_subcategory contains angle brackets, quotes, or backslashes
Temporarily disable the CAMOS form for users who do not require it until the patched release is deployed

bash

# Example nginx WAF-style rule to block obvious XSS in the vulnerable parameter
location /interface/forms/CAMOS/new.php {
    if ($request_method = POST) {
        if ($request_body ~* "hidden_subcategory=[^&]*(<|>|script|javascript:|onerror=)") {
            return 403;
        }
    }
}