Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as admin user
-
DeliveryAccess PostCalendar categoriesUpdate function
-
ExploitInject SQL in dels parameter
-
ExecutionExecute arbitrary database commands
-
ImpactExfiltrate or modify health records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access as OpenEMR administrator. Attacker must access the PostCalendar module's categoriesUpdate administrative function and inject SQL via the |
| Impact | The CVSS score of 7.2 (High) reflects the potential for complete compromise of confidentiality, integrity, and availability, but this is tempered by the PR:H (high privileges required) constraint, meaning only authenticated administrators can exploit it. The network attack vector (AV:N) and low complexity (AC:L) make exploitation straightforward once admin access is obtained. Without EPSS or KEV data provided, we cannot confirm active exploitation in the wild, but the availability of a public GitHub Security Advisory (GHSA-rq3v-38x5-3rm5) and a specific patch commit (1b851fc9af84f181ad7a84210a168d0d568cd442) indicates the vulnerability is publicly documented with technical details accessible to attackers. For healthcare organizations using OpenEMR, this represents a significant risk due to the sensitive nature of patient health information (PHI) and HIPAA compliance requirements, even though exploitation requires compromised admin credentials. The real-world risk is moderate-high: not an immediate internet-wide threat like unauthenticated RCE, but a serious concern for organizations with weak admin account security or insider threat scenarios. |
| Exploit ScenarioDerived | An attacker who has compromised an OpenEMR administrator account (through phishing, credential stuffing, or insider access) navigates to the PostCalendar categoriesUpdate administrative function and crafts a malicious POST request with a SQL injection payload in the dels parameter. Because the input is only HTML-sanitized but not SQL-escaped, the attacker can inject blind SQL commands to extract sensitive patient health records, authentication credentials, or other database contents through time-based or boolean-based blind SQL injection techniques. With sufficient SQL manipulation, the attacker could also modify medical records, delete audit logs to cover their tracks, or execute stored procedures if database permissions allow, all while appearing as legitimate administrative activity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
A blind SQL injection vulnerability exists in the PostCalendar module of OpenEMR, a widely-used open source electronic health records system. Versions prior to 8.0.0.3 are affected, allowing authenticated administrators to execute arbitrary SQL commands through the categoriesUpdate function's dels parameter. The vulnerability requires high privileges (PR:H) but is network-accessible and has no attack complexity, enabling attackers to extract sensitive patient data, modify health records, or disrupt medical operations.
RemediationAI
Upgrade OpenEMR to version 8.0.0.3 or later, which contains the patch addressing this SQL injection vulnerability as documented in commit 1b851fc9af84f181ad7a84210a168d0d568cd442 available at https://github.com/openemr/openemr/commit/1b851fc9af84f181ad7a84210a168d0d568cd442. Review the GitHub Security Advisory at https://github.com/openemr/openemr/security/advisories/GHSA-rq3v-38x5-3rm5 for complete details. As an interim mitigation if immediate patching is not possible, implement strict administrative access controls including multi-factor authentication for all admin accounts, monitor and audit administrative actions in the PostCalendar module, restrict admin panel access to trusted IP ranges via firewall rules or web application firewall policies, and review database query logs for suspicious DELETE operations. Given the healthcare context, prioritize patching to maintain HIPAA compliance and protect patient health information.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenEMR (cpe:2.3:a:openemr:openemr) is an electronic health records and medical practice management application. This vulnerability is classified as CWE-89 (SQL Injection) and occurs in the PostCalendar module's categoriesUpdate administrative function. The vulnerable code path reads the dels POST parameter through pnVarCleanFromInput(), a sanitization function that only strips HTML tags without performing SQL escaping or parameterization. This unsanitized input is then directly concatenated into a raw SQL DELETE statement and executed via Doctrine DBAL's executeStatement() method. While Doctrine DBAL supports parameterized queries to prevent SQL injection, the application uses string interpolation instead, bypassing the framework's built-in protections and creating a classic blind SQL injection vector.
Know when Openemr gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the PostCalendar module contains a blind SQL injection vulnerability in the categoriesUpdate administrative function. The dels POST parameter is read via pnVarCleanFromInput(), which only strips HTML tags and performs no SQL escaping. The value is then interpolated directly into a raw SQL DELETE statement that is executed unsanitized via Doctrine DBAL's executeStatement(). Version 8.0.0.3 patches the issue.
Executive ViewAI
OpenEMR installations running versions prior to 8.0.0.3 contain a SQL injection vulnerability in the PostCalendar module that could allow compromised administrator accounts to extract or modify patient health records. This poses immediate risk to patient data confidentiality and organizational compliance with HIPAA and other healthcare regulations.
Disable PostCalendar module categoriesUpdate functionality if not operationally critical; implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the dels parameter; restrict network access to OpenEMR administrative interfaces using IP whitelisting and VPN; enforce multi-factor authentication for all administrator accounts; increase logging and monitoring of SQL queries from the PostCalendar module; implement database activity monitoring (DAM) to detect anomalous SQL execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)GitHub Advisory
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
Remote code execution in OpenEMR through 8.2.0 lets an authenticated administrator poison the document category tree so
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
Exploit-DB