CVE-2022-31493

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in LibreHealth EHR Base version 2.0.0 [2]. The flaw resides in /gacl/admin/acl_admin.php and is triggered by the acl_id GET parameter [1]. The application fails to sanitize or encode the user-supplied acl_id value before rendering it in the response, allowing an attacker to inject arbitrary JavaScript [1].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL that includes a acl_id parameter containing HTML and JavaScript payloads [1]. The victim must be logged into LibreHealth EHR and click on the attacker-supplied link; no additional authentication or special network position is required beyond standard web access [1].

Impact

Successful exploitation enables an attacker to execute arbitrary JavaScript in the context of the victim's browser session [1]. This can lead to session hijacking, phishing, or defacement of the application interface. The attack is limited to the scope of the XSS and does not grant server-side code execution [1].

Mitigation

As of the publication date (2022-06-06), no official patch or fixed version has been released. The vendor has not issued an advisory or acknowledged a fix in subsequent releases [2]. Organizations should restrict access to the vulnerable endpoint, sanitize user input for the acl_id parameter, and consider using a Web Application Firewall (WAF) to block malicious payloads until a patch becomes available.