CVE-2026-124469

Summary

OpenEMR before 8.3.0 contains an SQL injection flaw in the Fee Sheet drug-inventory lookup where the POST field prod[N][warehouse] is interpolated into an ORDER BY clause without sanitization. Authenticated low-privileged users can exploit this to perform time-based blind SQL injection, extracting sensitive data including patient records and bcrypt-hashed credentials.

Exploitability

Exploitation requires valid low-privileged authentication and the ability to submit crafted POST requests to the Fee Sheet drug-inventory endpoint; public exploits exist, making exploitation straightforward for attackers with minimal skill.

Blast radius

Successful exploitation allows full compromise of patient data and credential theft, potentially affecting all users and patients in the system due to access to bcrypt hashes and sensitive health information.

Detection

Defenders should monitor web server access logs for POST requests to endpoints handling drug-inventory lookups (e.g., /interface/billing/drug_sales_service.php) containing suspicious ORDER BY patterns in the prod[N][warehouse] parameter, such as subqueries with SLEEP(), BENCHMARK(), or conditional time delays; elevated response times correlated with such requests may indicate exploitation.

Prioritized remediation

Upgrade to OpenEMR version 8.3.0 or later, which patches this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.