CVE-2020-13562: 
OpenEMR vulnerability analysis and mitigation

A cross-site scripting (XSS) vulnerability exists in the template functionality of phpGACL 3.3.7, specifically in the template action parameter. The vulnerability was discovered by Claudio Bozzato of Cisco Talos and was publicly disclosed on January 27, 2021. The affected software includes phpGACL 3.3.7 and OpenEMR versions 5.0.2 and 6.0.0 (development version) (Talos Report).

The vulnerability occurs when the GET parameter 'action' in admin/acl_admin.php is not properly escaped when rendered in the template. The template uses Smarty for templating, but multiple variables are not escaped correctly when rendered, leading to cross-site scripting. The CVSS v3.0 score is 9.6 (Critical) with vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The vulnerability is classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) (Talos Report).

A successful exploitation of this vulnerability could lead to arbitrary JavaScript execution in the context of the victim's browser. This could potentially allow attackers to steal sensitive information, manipulate web content, or perform actions on behalf of the victim (Talos Report).

The vulnerability can be exploited by sending a specially crafted HTTP request or URL to trigger arbitrary JavaScript execution. A proof of concept exploit has been demonstrated using the URL: http://openemr.dev/gacl/admin/acl_admin.php?action=\">alert(1) (Talos Report).

The vulnerability was patched by the vendor on January 5, 2021. Users are advised to update to the latest version of phpGACL that contains the security fix (Talos Report).