SQL injection in OpenEMR - #VU158850

Vulnerability details

The vulnerability allows a remote user to disclose sensitive database information and modify arbitrary patients' demographics, potentially enabling patient-portal account takeover through disclosure of an active reset value.

The vulnerability exists due to SQL injection in OpenEMR's CCR/CCDA approval insertApprovedData() methods when processing request-controlled patient-data field names. A remote user can submit a crafted request to /interface/modules/zend_modules/public/ccr/revandapprove that embeds a scalar SQL expression in a field name concatenated into an UPDATE statement to read data across database tables and modify an arbitrary patient's demographics without patient-access or pending-import checks.

Affected software

Remediation

External References

• https://github.com/openemr/openemr/security/advisories/GHSA-wh28-4qcg-5hcc

Related Security Bulletins

• Multiple vulnerabilities in OpenEMR