CVE-2026-126430: OpenEMR before 8.5.0 SQL Injection via CCR revandapprove Field Names
OpenEMR before 8.5.0 contains an sql injection vulnerability that allows any authenticated core user to inject SQL by supplying crafted patientdata field names to the CCR revandapprove controller. Attackers can embed scalar subqueries in the UPDATE patientdata SET clause to read staff password hashes and portal reset values, alter arbitrary patient demographics, and take over patient-portal accounts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated OpenEMR core user can exploit it. No user interaction is required.
What can an attacker do after exploitation?
An attacker can use scalar subqueries to read staff password hashes and portal reset values, modify arbitrary patient demographic data, and take over patient-portal accounts.
Which installations need remediation?
OpenEMR installations running versions before 8.5.0 are affected.