EUVD-2026-52342
GHSA-v687-rxcc-g864
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint requires high-privilege admin authentication; full C/I/A impact on the database; no scope change to other systems at the base level.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the form_step=202 parameter in backup.php. Attackers can exploit the unfiltered shell_exec invocation of the mysql command-line client to extract credential hashes, modify access control tables, inject backdoor accounts, create persistent triggers or stored procedures, and write arbitrary files to the filesystem where MySQL FILE privileges and permissive secure_file_priv settings are configured.
AnalysisAI
SQL injection and arbitrary file write in OpenEMR through 8.2.0 expose the full application database to compromise by any user holding admin or super ACL privileges. The backup configuration import feature at backup.php passes uploaded SQL files directly to a shell_exec invocation of the mysql binary without sanitization, enabling unrestricted DDL and DML execution including credential hash extraction, ACL table manipulation, backdoor account injection, and - under permissive MySQL FILE privilege settings - webshell deployment to the filesystem. A publicly available proof-of-concept exists per VulnCheck and a JivaSecurity exploit writeup; no CISA KEV listing is present, so active exploitation is not confirmed, though the low technical barrier post-authentication makes opportunistic insider exploitation realistic.
Technical ContextAI
OpenEMR is a PHP-based open-source electronic health records and practice management platform widely deployed in community health and clinical settings. The vulnerable code path is in backup.php at the form_step=202 parameter, which handles backup configuration imports. Rather than processing uploaded SQL content through a parameterized database layer, the application shells out to the system mysql binary via PHP's shell_exec() with the uploaded file as input - bypassing all query parameterization and input validation. This effectively converts a file upload endpoint into an unconstrained SQL execution interface. NVD formally classifies this as CWE-434 (Unrestricted Upload of File with Dangerous Type), but the mechanism also exhibits characteristics of CWE-78 (OS Command Injection via shell_exec) and CWE-89 (SQL Injection). The mysql client executes with the application's database credentials, which in typical OpenEMR deployments hold broad DDL and DML rights. The CPE string cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:* covers all OpenEMR versions through 8.2.0 with no version floor specified.
RemediationAI
No vendor-released patched version has been independently confirmed from the available data - administrators should monitor the official OpenEMR GitHub repository and the VulnCheck advisory at https://www.vulncheck.com/advisories/openemr-authenticated-sql-injection-via-backup-php-import-feature for a remediation release. In the interim, restrict access to backup.php at the web server level using Apache Location directives or nginx deny rules, limiting it to trusted administrative IP ranges only; this eliminates the network-accessible attack surface without affecting clinical workflows. If the backup import functionality is not operationally required, disable it entirely via web server configuration. Revoke the MySQL FILE privilege from the application's database user (REVOKE FILE ON *.* FROM 'openemr'@'%') and set secure_file_priv to a non-permissive path in my.cnf to eliminate the filesystem write vector; note this has no impact on normal EHR operation. Audit all accounts holding admin or super ACL roles in OpenEMR's access control tables and enforce multi-factor authentication on administrative logins to reduce credential-compromise risk. Review the application database user's DDL rights (CREATE, DROP, ALTER) and revoke any that are not required for routine application operation, accepting the trade-off of potential issues with future schema migrations.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today