Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the PostCalendar module contains a blind SQL injection vulnerability in the categoriesUpdate administrative function. The dels POST parameter is read via pnVarCleanFromInput(), which only strips HTML tags and performs no SQL escaping. The value is then interpolated directly into a raw SQL DELETE statement that is executed unsanitized via Doctrine DBAL's executeStatement(). Version 8.0.0.3 patches the issue.
AnalysisAI
A blind SQL injection vulnerability exists in the PostCalendar module of OpenEMR, a widely-used open source electronic health records system. Versions prior to 8.0.0.3 are affected, allowing authenticated administrators to execute arbitrary SQL commands through the categoriesUpdate function's dels parameter. The vulnerability requires high privileges (PR:H) but is network-accessible and has no attack complexity, enabling attackers to extract sensitive patient data, modify health records, or disrupt medical operations.
Technical ContextAI
OpenEMR (cpe:2.3:a:openemr:openemr) is an electronic health records and medical practice management application. This vulnerability is classified as CWE-89 (SQL Injection) and occurs in the PostCalendar module's categoriesUpdate administrative function. The vulnerable code path reads the dels POST parameter through pnVarCleanFromInput(), a sanitization function that only strips HTML tags without performing SQL escaping or parameterization. This unsanitized input is then directly concatenated into a raw SQL DELETE statement and executed via Doctrine DBAL's executeStatement() method. While Doctrine DBAL supports parameterized queries to prevent SQL injection, the application uses string interpolation instead, bypassing the framework's built-in protections and creating a classic blind SQL injection vector.
RemediationAI
Upgrade OpenEMR to version 8.0.0.3 or later, which contains the patch addressing this SQL injection vulnerability as documented in commit 1b851fc9af84f181ad7a84210a168d0d568cd442 available at https://github.com/openemr/openemr/commit/1b851fc9af84f181ad7a84210a168d0d568cd442. Review the GitHub Security Advisory at https://github.com/openemr/openemr/security/advisories/GHSA-rq3v-38x5-3rm5 for complete details. As an interim mitigation if immediate patching is not possible, implement strict administrative access controls including multi-factor authentication for all admin accounts, monitor and audit administrative actions in the PostCalendar module, restrict admin panel access to trusted IP ranges via firewall rules or web application firewall policies, and review database query logs for suspicious DELETE operations. Given the healthcare context, prioritize patching to maintain HIPAA compliance and protect patient health information.
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today