CVE-2026-126480: OpenEMR before 8.5.0 SQL Injection via CCR revandapprove Parameter Names
OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows authenticated users to inject SQL through request parameter names used as column names. Attackers can send crafted patientdata--sel parameters to the revandapprove route, lacking ACL and CSRF checks, to copy password hashes into patient fields or corrupt records.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated to OpenEMR and able to send requests to the revandapprove route. The affected route lacks ACL checks, so exploitation is not restricted by an access-control check on that functionality.
What does an attacker need to send?
The attacker can craft request parameter names in the patient_data-*-sel form, which are used as SQL column names by CcrTable::insertApprovedData(). No user interaction is required.
What is the potential impact?
An attacker may copy password hashes into patient fields or corrupt records. The vulnerability is rated high severity with impacts to confidentiality and integrity.
Which versions are affected and what is the remediation?
OpenEMR versions before 8.5.0 are affected. Upgrade to version 8.5.0 or later.