Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as high-privilege user
-
DeliveryAccess patient selection feature
-
ExploitInject SQL payload into input field
-
ExecutionExecute unauthorized database queries
-
ImpactExtract sensitive patient records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated attacker with high-privilege access (administrator or provider role) to OpenEMR versions up to 8.0.0.2. Attacker must access the patient selection feature via network. No user interaction required. Exploitation occurs through crafted SQL injection payloads in patient selection input fields. |
| Impact | The CVSS v3.1 score of 7.2 (High) reflects significant impact across confidentiality, integrity, and availability (all rated High), but the risk is substantially mitigated by requiring high privileges (PR:H) and authenticated access. The network attack vector (AV:N) and low attack complexity (AC:L) indicate that once an attacker has privileged credentials, exploitation is straightforward. However, the requirement for high-privilege authentication significantly reduces the attack surface compared to unauthenticated or low-privilege vulnerabilities. In healthcare environments where OpenEMR is deployed, the sensitivity of protected health information (PHI) elevates the impact of successful exploitation. The absence from CISA KEV and lack of public proof-of-concept suggests this is not being actively exploited in the wild. This should be prioritized for patching in healthcare environments due to data sensitivity, but the authentication requirement makes it lower priority than vulnerabilities exploitable by low-privileged or unauthenticated attackers. |
| Exploit ScenarioDerived | An authenticated attacker with high-level privileges (such as a compromised administrator account or malicious insider) accesses the patient selection feature in OpenEMR and injects malicious SQL commands through insufficient input validation points. The attacker crafts SQL payloads to extract sensitive patient health information including diagnoses, medications, and personal identifiable information, or modifies medical records to alter treatment histories. Due to the low attack complexity indicated in the CVSS vector, exploitation is straightforward once the attacker has obtained the necessary privileged credentials through phishing, credential theft, or insider threat scenarios. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
OpenEMR versions up to and including 8.0.0.2 contain a SQL injection vulnerability in the patient selection feature that allows authenticated attackers with high privileges to execute arbitrary SQL commands. The vulnerability stems from insufficient input validation and can lead to complete compromise of confidentiality, integrity, and availability of the healthcare database. No evidence of active exploitation (not in CISA KEV) or public proof-of-concept is currently available.
RemediationAI
Upgrade OpenEMR to version 8.0.0.3 or later, which contains a security patch that addresses the SQL injection vulnerability as documented in the release notes at https://github.com/openemr/openemr/releases/tag/v8_0_0_3. The specific remediation commit can be reviewed at https://github.com/openemr/openemr/commit/73db3264aed253684532839380cae3b0a56c83d2 for technical verification. Until patching can be completed, organizations should review and restrict user accounts with high-privilege access to the patient selection feature, implement additional monitoring for suspicious database queries or unusual data access patterns, and ensure comprehensive audit logging is enabled to detect potential exploitation attempts. Given that this vulnerability requires authenticated high-privilege access, focusing on proper access control and principle of least privilege can provide interim risk reduction.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenEMR is an open-source electronic health records (EHR) and medical practice management application used in healthcare environments. The vulnerability is classified as CWE-89 (SQL Injection), occurring when user-supplied input in the patient selection feature is not properly sanitized before being incorporated into SQL queries. The affected product is identified via CPE cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:* covering all versions up to 8.0.0.2. SQL injection vulnerabilities allow attackers to manipulate database queries, potentially bypassing authentication, extracting sensitive patient data protected under regulations like HIPAA, modifying medical records, or executing administrative operations on the database server.
Know when Openemr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Versions up to and including 8.0.0.2 contain a SQL injection vulnerability in the patient selection feature that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the patient selection feature. Version 8.0.0.3 contains a patch.
Executive ViewAI
OpenEMR installations (versions up to 8.0.0.2) face a high-risk SQL injection vulnerability that could allow privileged insiders to breach patient database confidentiality and integrity. Without an available patch, immediate compensating controls are required to protect sensitive healthcare data and maintain HIPAA compliance.
Implement Web Application Firewall (WAF) rules targeting SQL injection payloads in patient selection parameters; enforce database-level query restrictions and stored procedures with parameterized queries; segregate OpenEMR database network access; disable or restrict the patient selection feature to essential administrative users only; enforce multi-factor authentication for high-privilege accounts; enable comprehensive database audit logging; implement real-time database anomaly detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)GitHub Advisory
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
Exploit-DB