CVE-2026-126460: OpenEMR before 8.5.0 Persistent SQL Injection via ERA File Reprocessing
OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber(), where the CLP01 claim control number from uploaded X12 835 ERA files is concatenated unescaped into a query. Attackers with billing write access can upload a crafted .edi file via sleobsearch.php that is stored on the server and re-executes a time-based payload whenever it is reprocessed through sleobprocess.php, extracting patient health information.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs billing write access to upload a crafted X12 835 ERA .edi file through sl_eob_search.php. The attack does not require user interaction after the malicious file is uploaded.
What makes the SQL injection persistent?
The crafted CLP01 claim control number is stored in the uploaded ERA file on the server. Its payload runs again whenever that file is reprocessed through sl_eob_process.php.
What data could be exposed?
The described impact includes extraction of patient health information through time-based SQL injection. The provided vector rates confidentiality impact as high and integrity impact as low.
Which versions are affected?
OpenEMR versions before 8.5.0 are affected. The provided data does not identify a separate configuration prerequisite beyond billing write access and ERA file processing.