Openemr CVE-2026-29187

Requires authenticated user account in OpenEMR versions prior to 8.0.0.3. Attacker manipulates HTTP parameter keys in Patient Search functionality (/interface/new/new_search_popup.php) to inject SQL commands. No victim interaction needed beyond attacker possessing valid login credentials.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates this is a network-exploitable vulnerability with low attack complexity requiring only low-level authentication, no user interaction, and delivering high confidentiality and integrity impact. While the 8.1 score suggests high severity, the PR:L requirement (authenticated access needed) reduces immediate internet-wide exploitation risk compared to unauthenticated vulnerabilities. The medical context significantly elevates real-world risk as OpenEMR handles HIPAA-protected patient health information, making data exfiltration particularly damaging from regulatory and privacy perspectives. A patch is available in version 8.0.0.3 with a specific commit reference, indicating the vendor has addressed the issue. Given OpenEMR's widespread use in healthcare settings, the availability of technical details in the GitHub Security Advisory (GHSA-2r7h-xm8v-m872), and the relative ease of exploitation once authenticated, this should be considered a high-priority remediation item for organizations running affected versions, particularly those in regulated healthcare environments.

An attacker with valid low-privileged credentials to an OpenEMR installation accesses the Patient Search functionality at /interface/new/new_search_popup.php and crafts malicious HTTP requests where the parameter keys themselves contain SQL injection payloads rather than the parameter values. Using blind SQL injection techniques, the attacker iteratively extracts sensitive patient health information, user credentials, and other confidential database contents by observing application response timing or boolean conditions, eventually gaining access to the entire EHR database or escalating privileges to modify patient records.