Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the PostCalendar module contains a blind SQL injection vulnerability in the categoriesUpdate administrative function. The dels POST parameter is read via pnVarCleanFromInput(), which only strips HTML tags and performs no SQL escaping. The value is then interpolated directly into a raw SQL DELETE statement that is executed unsanitized via Doctrine DBAL's executeStatement(). Version 8.0.0.3 patches the issue.
AnalysisAI
A blind SQL injection vulnerability exists in the PostCalendar module of OpenEMR, a widely-used open source electronic health records system. Versions prior to 8.0.0.3 are affected, allowing authenticated administrators to execute arbitrary SQL commands through the categoriesUpdate function's dels parameter. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires authenticated access as OpenEMR administrator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS score of 7.2 (High) reflects the potential for complete compromise of confidentiality, integrity, and availability, but this is tempered by the PR:H (high privileges required) constraint, meaning only authenticated administrators can exploit it. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised an OpenEMR administrator account (through phishing, credential stuffing, or insider access) navigates to the PostCalendar categoriesUpdate administrative function and crafts a malicious POST request with a SQL injection payload in the dels parameter. Because the input is only HTML-sanitized but not SQL-escaped, the attacker can inject blind SQL commands to extract sensitive patient health records, authentication credentials, or other database contents through time-based or boolean-based blind SQL injection techniques. … |
| Remediation | Upgrade OpenEMR to version 8.0.0.3 or later, which contains the patch addressing this SQL injection vulnerability as documented in commit 1b851fc9af84f181ad7a84210a168d0d568cd442 available at https://github.com/openemr/openemr/commit/1b851fc9af84f181ad7a84210a168d0d568cd442. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all OpenEMR instances and their versions; restrict administrative access to PostCalendar module functionality; review recent administrator account activity logs for suspicious SQL-like activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today