CVE-2026-126478: OpenEMR before 8.5.0 SQL Injection via form_icd_codes in Syndromic Surveillance
OpenEMR before 8.5.0 contains an SQL injection vulnerability in the Syndromic Surveillance report because the formicdcodes[] POST array is concatenated into an unquoted numeric IN() clause without integer validation. Authenticated users can submit quote-free payloads that bypass addescapecustom to perform blind or UNION-based injection and exfiltrate patient health information.
Event History
Frequently Asked Questions
Which deployments are affected?
OpenEMR versions before 8.5.0 are affected where authenticated users can access the Syndromic Surveillance report.
What access does an attacker need?
An attacker needs an authenticated OpenEMR account and the ability to submit POST data to the Syndromic Surveillance report. No user interaction is required.
What data could be exposed?
The injection can be used for blind or UNION-based SQL injection to exfiltrate patient health information. The reported impact also includes limited integrity and availability effects.
What is the immediate remediation?
Upgrade OpenEMR to version 8.5.0 or later. The affected behavior is the handling of the form_icd_codes[] POST array in the Syndromic Surveillance report.