CVE-2026-126425: OpenEMR before 8.5.0 Stored SQL Injection via History Layout Field Identifiers
OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved through editlayout.php, including HIS fields and LBF source-H fields, are placed unvalidated into an INSERT statement for patients without a historydata row. Users with admin/super and patients/med write access can trigger historysave.php or LBF saves to execute SQL functions like SLEEP, tying up database workers or accessing data beyond their privileges.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Exploitation requires an authenticated user with admin/super privileges and patients/med write access. The attacker must be able to save crafted History layout field identifiers through edit_layout.php and then trigger history_save.php or an LBF save.
When does the vulnerable SQL path execute?
The unvalidated field identifier is inserted into SQL when handling a patient who does not yet have a history_data row. This makes newly created or otherwise uninitialized patient history records relevant to exploitation.
What can an attacker do through the injection?
The issue can be used to execute SQL functions such as SLEEP, which can tie up database workers. It may also permit access to data beyond the attacker's assigned privileges.
Which versions are affected?
OpenEMR versions before 8.5.0 are affected. The provided information does not identify affected configurations beyond the required privileges and the history-data condition.