SQL injection in OpenEMR - #VU158842
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote privileged user to execute unauthorized SQL expressions, disclose database information, alter History data, and consume database and web-worker capacity.
The vulnerability exists due to improper validation of SQL identifiers in OpenEMR's SocialHistoryService::insertRecord() when inserting History data using stored layout field identifiers. A remote privileged user can store a crafted identifier such as tobacco`=sleep(3),`exams in a HIS layout or a source-H field in an LBF layout and submit the corresponding History data to inject SQL expressions into an INSERT statement, enabling unauthorized database operations and delays in affected saves.
Exploitation requires a patient without an existing history_data row. Opening either History page creates that row. Field identifiers are limited to 24 characters, constraining the available SQL payloads.