Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, several variables in the MedEx recall/reminder processing code are concatenated directly into SQL queries without parameterization or type casting, enabling SQL injection. Version 8.0.0.3 contains a patch.
AnalysisAI
OpenEMR versions prior to 8.0.0.3 contain a SQL injection vulnerability in the MedEx recall/reminder processing code where user-controlled variables are concatenated directly into SQL queries without parameterization or type casting. An authenticated attacker with high privileges can exploit this to extract, modify, or delete sensitive healthcare data from the database. While the CVSS score of 5.9 is moderate, the attack requires high privilege level (PR:H) and high complexity (AC:H), but the confidentiality and integrity impacts are severe given the medical context.
Technical ContextAI
The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and stems from unsafe string concatenation in database query construction within OpenEMR's MedEx module, which handles patient recall and reminder communications. The affected product (cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*) indicates all versions of OpenEMR are potentially affected through version 8.0.0.2. The MedEx processing code fails to use parameterized queries or prepared statements, instead directly interpolating user-supplied input into SQL commands. This classic SQL injection pattern allows attackers to break out of intended query logic and execute arbitrary SQL operations against the underlying database.
RemediationAI
Immediately upgrade OpenEMR to version 8.0.0.3 or later, which contains the parameterized query fixes for the MedEx module (see https://github.com/openemr/openemr/security/advisories/GHSA-6vx2-w9hw-prqj). For organizations unable to patch immediately, implement strict database access controls limiting SQL query execution to least-privileged service accounts, enforce network segmentation to restrict access to OpenEMR database ports to trusted internal systems only, and enable comprehensive SQL query logging and monitoring to detect anomalous database activity. Additionally, restrict administrative access to the MedEx configuration and processing features to only essential personnel. While these mitigations reduce attack surface, they do not eliminate the vulnerability and should be considered temporary measures only.
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today