OpenEMR CVE-2026-49142

Requires an authenticated OpenEMR session with Clinician-level privileges or higher (the CVSS vector confirms PR:L) and network access to the Syndromic Surveillance module's syndromicsurveillance/index endpoint. The concrete trigger is the form_icd_codes[] POST parameter, whose values are imploded directly into an unquoted numeric SQL IN() clause where add_escape_custom() (which only escapes quotes/backslashes) provides no protection; the vendor-documented payload is comment-free and parenthesis-balanced (re-opening IN( to keep four bound placeholders intact) and uses hex-encoded literals since quotes are stripped. No non-default configuration is described as necessary beyond the module being present and the attacker holding a Clinician+ account - that credential requirement is the primary limiting factor, confining realistic exploitation to insiders or attackers who have compromised a privileged account rather than unauthenticated remote attackers.

Signals are mostly consistent and point to a genuine but access-gated priority. The CVSS 4.0 base score of 8.7 (High) reflects a network-reachable (AV:N), low-complexity (AC:L), no-interaction (UI:N) flaw with high confidentiality, integrity and availability impact - but it requires PR:L, i.e. an authenticated Clinician-level or higher account, which is the single most important mitigating factor. The vendor security advisory (GHSA-w99c-jwcm-24hh) publishes a complete, step-by-step proof-of-concept exploit script with confirmed output, so a working exploitation path is documented and reproducible. The vuln.today Decision label is 'this_week' (not act_now/emergency), consistent with a serious flaw that still demands valid privileged credentials rather than being remotely unauthenticated. No EPSS probability and no CISA KEV status were provided in the input, so widespread or confirmed in-the-wild exploitation cannot be asserted - exploitation status here is best characterized as a published PoC rather than observed active attacks. Net: this is a real, high-impact issue warranting prompt patching (the chain yields full administrative takeover), but the authentication prerequisite means realistic exploitation depends on a malicious insider or a compromised/phished Clinician account rather than opportunistic internet-wide scanning. Missing data to note explicitly: EPSS score absent and KEV status absent in the provided intelligence.

An attacker holding a Clinician-level (or higher) OpenEMR session - a malicious insider, or an outsider who phished or otherwise compromised a clinician's credentials - submits crafted values in the form_icd_codes[] POST parameter to the syndromicsurveillance/index endpoint. Using an unquoted numeric IN()/UNION injection with hex-encoded literals, they abuse MySQL extractvalue() for error-based exfiltration of all bcrypt hashes from users_secure, then run a stacked UPDATE to reset the admin password and take over the account. A complete working PoC script (sqli_takeover.py) with confirmed output is published in the vendor's GHSA advisory.