Openemr
CVE-2026-24908
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to OpenEMR REST API
-
DeliverySend crafted _sort parameter in Patient endpoint
-
ExploitInject SQL into ORDER BY clause
-
ExecutionExecute arbitrary SQL queries
-
ImpactExtract PHI and credentials from database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated API access to OpenEMR Patient REST API endpoint required; attacker must possess valid API credentials prior to version 8.0.0; no special database or configuration settings needed beyond standard OpenEMR deployment. |
| Impact | CVSS 9.9, PoC available. EHR system SQL injection — potential HIPAA breach. PHI exposure from across the entire medical practice. |
| Exploit ScenarioDerived | Authenticated user (e.g., front desk staff) injects SQL to access all patient records, diagnoses, prescriptions, and financial data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the medical records system. PoC and patch available.
Earlier versions of this analysis (1)
SQL injection in OpenEMR electronic health records.
RemediationAI
Apply OpenEMR patch. Audit database access logs. HIPAA breach assessment may be required.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-89 SQL injection with scope change (CVSS 9.9). Authenticated users can inject SQL to access data beyond their authorization scope.
Know when Openemr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Patient REST API endpoint allows authenticated users with API access to execute arbitrary SQL queries through the _sort parameter. This could potentially lead to database access, PHI (Protected Health Information) exposure, and credential compromise. The issue occurs when user-supplied sort field names are used in ORDER BY clauses without proper validation or identifier escaping. Version 8.0.0 fixes the issue.
Executive ViewAI
A critical SQL injection vulnerability in OpenEMR's Patient REST API allows authenticated users with API access to execute arbitrary database queries, potentially exposing or modifying protected health information (PHI) at scale. This poses significant compliance risks under HIPAA and threatens the confidentiality and integrity of patient records across all instances running versions prior to 8.0.0.
Apply vendor patch. If immediate patching is not possible: implement WAF rules to block REST API requests containing _sort parameters with SQL syntax; disable or restrict Patient REST API endpoint access to essential services only; enable database query logging and real-time alerting on suspicious SQL patterns; implement network segmentation to limit API consumer access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)GitHub Advisory
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code
Exploit-DB