Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionGitHub Advisory
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 contais a SQL injection vulnerability in the ajax_save CAMOS form that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the ajax_save page in the CAMOS form. Version 8.0.0.3 patches the issue.
AnalysisAI
SQL injection in OpenEMR versions prior to 8.0.0.3 enables authenticated attackers to execute arbitrary SQL commands through the CAMOS form's ajax_save functionality, potentially leading to complete database compromise including extraction of sensitive health records, data modification, and service disruption. The vulnerability requires low-privilege authentication (PR:L) with no user interaction (UI:N) and is network-exploitable (AV:N), though EPSS assigns only 0.03% (8th percentile) exploitation probability and no public exploit identified at time of analysis. Vendor-released patch available in version 8.0.0.3.
Technical ContextAI
OpenEMR is an open-source electronic health records (EHR) and medical practice management system widely deployed in healthcare settings. The vulnerability affects cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:* (versions prior to 8.0.0.3) and is classified as CWE-89 (SQL Injection), indicating insufficient input validation and sanitization in the ajax_save endpoint of the CAMOS (Computer Aided Medical Ordering System) form module. Attackers can inject malicious SQL commands through form parameters that are improperly handled during database queries, allowing direct interaction with the underlying database layer. The CAMOS module is used for clinical documentation and order entry, making it a critical component that handles sensitive patient health information subject to HIPAA and similar regulations.
RemediationAI
Upgrade OpenEMR to version 8.0.0.3 or later, which contains the fix for this SQL injection vulnerability as documented in the release notes at https://github.com/openemr/openemr/releases/tag/v8_0_0_3. The specific remediation code is available in commit 4d48821d18e4125508d8217c43b09233c7f7e17f at https://github.com/openemr/openemr/commit/4d48821d18e4125508d8217c43b09233c7f7e17f for administrators who need to verify the patch or apply it manually. Until patching is completed, implement defense-in-depth measures including restricting access to the CAMOS form module to only essential personnel, enforcing strong authentication policies, monitoring database query logs for SQL injection patterns, and deploying web application firewall rules to detect and block SQL injection attempts targeting the ajax_save endpoint. Review and rotate database credentials as a precautionary measure if exploitation is suspected.
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to
Unauthenticated token disclosure in OpenEMR before 8.0.0. CVSS 10.0. PoC and patch available.
Path traversal in OpenEMR 7.0.4 disposeDocument() allows file access. PoC available.
Path traversal in OpenEMR electronic health records before fix allows authenticated users to read arbitrary files on the
SQL injection in OpenEMR electronic health records before fix. Authenticated users can execute arbitrary SQL through the
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.cl
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid par
Information disclosure in OpenEMR 5.0.2 to before 8.0.0 exposes sensitive data. PoC and patch available.
interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shel
interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication
Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote
OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today