CVE-2025-67645

Executive Summary

CVE-2025-67645 is a critical broken access control vulnerability in OpenEMR, a widely used open-source electronic health records (EHR) and medical practice management application. The flaw resides in the Profile Edit endpoint, where an authenticated normal user can manipulate request parameters (pubpid / pid) to reference and modify another user’s profile data. This allows unauthorized alteration of sensitive information such as name, contact info, and could lead to account takeover. The vulnerability is assigned a CVSS score of 8.8 (High) and affects versions prior to 7.0.4. No public exploit code or nuclei template is currently available, but the risk is significant due to the sensitive nature of healthcare data.

Supply Chain & Package Security

OpenEMR is a PHP-based application distributed via GitHub and its official website. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Organizations should verify the integrity of their OpenEMR installation and ensure they are using a trusted source for updates.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated user
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is high due to the low complexity, low privileges required, and the potential for complete compromise of user accounts and sensitive health data.

Deep Dive & Mechanics

The vulnerability is a classic case of Insecure Direct Object Reference (IDOR) (CWE-639). The Profile Edit endpoint in OpenEMR does not properly verify that the authenticated user is authorized to modify the profile identified by the pubpid or pid parameters. An attacker can intercept the request (e.g., via browser developer tools or a proxy like Burp Suite) and change these parameters to target another user’s record. The server then processes the request as if it were legitimate, updating the targeted user’s profile.

This can be exploited to:

• Alter another user’s personal information (name, address, phone, email).
• Change security-related fields (e.g., password reset questions, email for notifications).
• Potentially escalate privileges if the target is an admin (though the vulnerability itself does not grant admin rights, it could be used in combination with other flaws).

The fix in version 7.0.4 likely involves server-side authorization checks to ensure the authenticated user can only modify their own profile.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In profile_edit.php (or similar)
$pid = $_REQUEST['pid'];
$pubpid = $_REQUEST['pubpid'];
// No check if $pid belongs to the current user
$sql = "UPDATE patient_data SET ... WHERE pid = ?";
sqlQuery($sql, array($pid));

Patched Code (Conceptual):

// In profile_edit.php (or similar)
$pid = $_REQUEST['pid'];
$pubpid = $_REQUEST['pubpid'];
// Verify the current user owns this record
if ($pid != $_SESSION['pid']) {
    die("Unauthorized");
}
$sql = "UPDATE patient_data SET ... WHERE pid = ?";
sqlQuery($sql, array($pid));

The patch adds a session-based check to ensure the pid matches the authenticated user’s own ID.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: An authenticated user account on a vulnerable OpenEMR instance (version < 7.0.4).
2. Steps:
   • Log in to OpenEMR as a normal user.
   • Navigate to the Profile Edit page (e.g., /interface/patient_file/summary/demographics.php).
   • Open browser developer tools (F12) and go to the Network tab.
   • Submit a profile change (e.g., update the phone number).
   • Find the POST request to the profile update endpoint.
   • Modify the pid or pubpid parameter to another user’s ID (e.g., change pid=123 to pid=456).
   • Send the modified request.
   • The server will update the targeted user’s profile.

Example Request (Burp Suite):

POST /interface/patient_file/summary/demographics.php HTTP/1.1
Host: target-openemr.com
Cookie: PHPSESSID=attacker_session
Content-Type: application/x-www-form-urlencoded

pid=456&fname=Hacked&lname=User&phone=555-0000

Blue Team (Detection & Defense)

1. Monitor for anomalous profile update requests where the pid parameter does not match the session user.
2. Implement Web Application Firewall (WAF) rules to block requests with manipulated pid values.
3. Enable detailed logging of all profile changes, including the original and modified parameters.
4. Conduct regular access control audits to ensure proper authorization checks are in place.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to profile endpoints with suspicious pid or pubpid values.
• Logs: Audit logs showing profile updates for users other than the authenticated session user.
• System: Unexpected changes to user profile data (e.g., name, email, phone) without user consent.

Detection Engineering

YARA Rule

rule CVE_2025_67645_OpenEMR_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2025-67645 in OpenEMR"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-67645"
    strings:
        $pid_param = "pid=" nocase
        $pubpid_param = "pubpid=" nocase
        $profile_endpoint = "demographics.php" nocase
    condition:
        all of them
}

Sigma Rule

title: OpenEMR IDOR Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-67645 by manipulating pid parameters
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'pid='
            - 'pubpid='
        cs-uri-stem|endswith: '/demographics.php'
    condition: selection
falsepositives:
    - Legitimate profile updates by authorized users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-67645 OpenEMR IDOR Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"demographics.php"; http_uri; content:"pid="; http_client_body; pcre:"/pid=\d+/"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to OpenEMR version 7.0.4 or later.
2. Workaround: If immediate upgrade is not possible, implement a reverse proxy or WAF rule to block requests with modified pid parameters.
3. Long-term: Conduct a thorough code review of all endpoints handling user-specific data to ensure proper authorization checks.
4. Monitoring: Enable detailed logging and alerting for any profile update anomalies.

Valters IT