SQL injection in OpenEMR - #VU158851
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote user to disclose sensitive database information, take over patient-portal accounts when active reset values exist, corrupt global C-CDA mappings, and degrade application availability.
The vulnerability exists due to improper neutralization of stored field identifiers in Carecoordination/Model/EncounterccdadispatchTable.php::fetchFormValues() when generating a mapped patient's C-CDA document. A remote user can submit a crafted field identifier through the Carecoordination setup savedata action, which persists it for later concatenation into an SQL IN (...) clause, to execute second-order SQL injection and extract patient records, staff password hashes, portal reset values, OAuth records, and configuration data, or execute repeated delay expressions to degrade availability.
Exploitation requires Carecoordination and C-CDA generation to be enabled.