Skip to main content

Openemr CVE-2026-24908

CRITICAL
SQL Injection (CWE-89)
2026-02-25 security-advisories@github.com
SQLi Openemr
9.9
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
9.9 CRITICAL
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Mar 12, 2026 - 21:55 vuln.today
PoC Detected
Feb 27, 2026 - 14:42 vuln.today
Public exploit code
Patch released
Feb 27, 2026 - 14:42 nvd
Patch available
CVE Published
Feb 25, 2026 - 19:43 nvd
CRITICAL 9.9

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Patient REST API endpoint allows authenticated users with API access to execute arbitrary SQL queries through the _sort parameter. This could potentially lead to database access, PHI (Protected Health Information) exposure, and credential compromise. The issue occurs when user-supplied sort field names are used in ORDER BY clauses without proper validation or identifier escaping. Version 8.0.0 fixes the issue.

AnalysisAI

SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the medical records system. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to OpenEMR REST API
Delivery
Send crafted _sort parameter in Patient endpoint
Exploit
Inject SQL into ORDER BY clause
Execution
Execute arbitrary SQL queries
Impact
Extract PHI and credentials from database
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Authenticated API access to OpenEMR Patient REST API endpoint required; attacker must possess valid API credentials prior to version 8.0.0; no special database or configuration settings needed beyond standard OpenEMR deployment. Additional conditions and limiting factors are described in the full assessment.
Risk Assessment CVSS 9.9, PoC available. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Authenticated user (e.g., front desk staff) injects SQL to access all patient records, diagnoses, prescriptions, and financial data.
Remediation Apply OpenEMR patch. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: inventory all OpenEMR deployments and versions; disable REST API access if not operationally critical. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-24908 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy