CVE-2026-126463: OpenEMR before 8.5.0 SQL Injection via billing parser, reports, Zend modules
OpenEMR before 8.5.0 contains multiple sql injection vulnerabilities that allow authenticated users to inject payloads through ERA CLP01, formfacility, formicdcodes, and POST key names. Attackers can perform UNION, blind, and error-based injection to read userssecure password hashes and patient PHI, and overwrite patientdata fields.
Event History
Frequently Asked Questions
Who can exploit these issues?
An attacker needs an authenticated OpenEMR account with low privileges; no user interaction is required. The vulnerabilities are remotely reachable over the network.
Which inputs are implicated?
The affected injection points include ERA CLP01, form_facility, form_icd_codes, and POST parameter names.
What could an attacker access or change?
An attacker may read users_secure password hashes and patient PHI through UNION, blind, or error-based SQL injection. They may also overwrite fields in patient_data.
Which versions are affected?
OpenEMR versions before 8.5.0 are affected. Upgrade to 8.5.0 or later.