CVE-2026-126482: OpenEMR before 8.5.0 SQL Injection via CLP01 element of X12 835 ERA upload
OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber() in src/Billing/SLEOB.php, which concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into a query without escaping or parameter binding. Authenticated users with billing permissions, or a malicious payer whose ERA file a clerk uploads, can execute arbitrary SQL to read any table, including userssecure password hashes, and modify data.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the vulnerable query?
An authenticated user with billing permissions can upload a crafted X12 835 ERA file. A malicious payer can also supply a crafted ERA file that is later uploaded by a billing clerk.
Does exploitation require interaction from another user?
No user interaction is required for a billing-permission user who uploads the malicious file themselves. In the malicious-payer scenario, exploitation depends on a clerk uploading the supplied ERA file.
What could an attacker access or change?
The SQL injection can execute arbitrary SQL. The reported impact includes reading any database table, including users_secure password hashes, and modifying data.
What should be prioritized for mitigation?
Upgrade OpenEMR to version 8.5.0 or later, since affected versions are before 8.5.0. Until then, restrict billing permissions and avoid uploading X12 835 ERA files from untrusted or insufficiently validated payer sources.