EUVD-2026-43199
GHSA-8g7p-3ghx-xx9x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable REST endpoint, no attack complexity, low-privilege authentication required; SQL injection impact conservatively scored Low across C/I/A consistent with vendor CVSS 4.0 assessment.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in Bahmni bahmnicore up to 0.93. This affects the function additionalParams of the file /openmrs/ws/rest/v1/bahmnicore/sql of the component Search Endpoint. Performing a manipulation of the argument test results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 0.93.1, 1.0.1, 1.1.1, 1.2.1, 1.3.1 and 2.0.1 mitigates this issue. Upgrading the affected component is recommended.
AnalysisAI
SQL injection in Bahmni bahmnicore up to version 0.93 allows low-privileged authenticated remote attackers to manipulate backend database queries via the additionalParams argument at the /openmrs/ws/rest/v1/bahmnicore/sql Search Endpoint. Public exploit code exists (confirmed by E:P in CVSS 4.0 supplemental metrics and the CVE description), lowering the bar for exploitation to any user with valid application credentials. Fixed versions spanning all active release branches (0.93.1 through 2.0.1) were released July 2026, and organizations running affected versions in healthcare environments should prioritize patching given the sensitivity of stored patient and clinical data.
Technical ContextAI
Bahmni is an open-source electronic health record (EHR) platform built on top of OpenMRS, primarily deployed in low-resource healthcare settings across developing regions. The vulnerable component, bahmnicore (CPE: cpe:2.3:a:bahmni:bahmnicore:*:*:*:*:*:*:*:*), exposes a SQL execution endpoint at /openmrs/ws/rest/v1/bahmnicore/sql that accepts a test argument passed through the additionalParams function. CWE-89 (SQL Injection) identifies the root cause as user-controlled input being incorporated directly into a SQL query without parameterization or proper sanitization. Because the endpoint is accessible via REST API over the network and does not require elevated privileges, any authenticated session is sufficient to deliver the injection payload. The OpenMRS backend database typically stores patient demographics, clinical notes, diagnoses, and medication histories, making a successful injection consequential beyond the moderate CVSS base score.
RemediationAI
The primary fix is to upgrade bahmnicore to the patched version matching the currently deployed release branch: 0.93.1, 1.0.1, 1.1.1, 1.2.1, 1.3.1, or 2.0.1. Full patch release notes are available at https://bahmni.atlassian.net/wiki/spaces/BAH/pages/5519474693/Bahmni+Security+Patch+July+02+2026+Release+Notes and the security advisory at https://github.com/Bahmni/bahmni-core/security/advisories/GHSA-cg9w-r5g6-cxq5. If immediate patching is not feasible, restrict access to the /openmrs/ws/rest/v1/bahmnicore/sql endpoint via WAF rules or reverse-proxy ACLs - note that this may impact legitimate search functionality and should be tested against workflows before enforcing. Additionally, limiting which roles and user accounts have access to the Search Endpoint reduces the attack surface; this does not eliminate the underlying vulnerability but narrows the pool of accounts that can trigger it. Enforcing multi-factor authentication for Bahmni user accounts further limits the viability of credential-based attack paths while a patch is being staged.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today