CVE-2022-31492

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in LibreHealth EHR Base 2.0.0 in the interface/usergroup/usergroup_admin_add.php script. The username parameter is not sanitized before being stored, allowing an attacker to inject arbitrary JavaScript [1]. The vulnerable version is 2.0.0 (released 2017-11-02) [2].

Exploitation

An attacker with access to the user group administration page can submit a malicious username containing JavaScript payloads. The payload is stored and executed when the page is loaded. No authentication bypass is needed; the attacker must have privileges to add users (e.g., admin role) [1].

Impact

Successful exploitation leads to stored cross-site scripting, enabling the attacker to execute arbitrary JavaScript in the context of the application. This can lead to session hijacking, defacement, or redirection to malicious sites. The impact is limited to actions available to the admin user's session [1].

Mitigation

No official patch has been released as of the publication date. Users are advised to restrict access to the user group administration functionality and apply input validation. The latest release is 2.0.0, and no newer version addresses this issue [1][2].