CVE-2026-126431: OpenEMR before 8.5.0 Second-Order SQL Injection via Carecoordination CCDA Mapper
OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination users to store malicious C-CDA field identifiers through the savedata action. Attackers can inject SQL into the IN clause built by fetchFormValues() during C-CDA generation to extract password hashes, portal reset values, and patient records.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated OpenEMR account with Carecoordination access. Exploitation does not require user interaction, but it requires the ability to submit the savedata action with malicious C-CDA field identifiers.
When is the injected SQL executed?
The payload is stored first and is later used during C-CDA generation. The injection occurs when fetchFormValues() builds an SQL IN clause from the stored field identifiers.
What data could be exposed or altered?
The vulnerability can be used to extract password hashes, portal reset values, and patient records. The provided information indicates high confidentiality and integrity impact, with no availability impact.
Which versions need remediation?
OpenEMR versions before 8.5.0 are affected. Upgrade to 8.5.0 or later.