CVE-2026-126483: OpenEMR before 8.5.0 SQL Injection via form_facility in ippf_statistics.php
OpenEMR before 8.5.0 contains an SQL injection vulnerability that allows authenticated report users to manipulate queries by supplying a crafted formfacility value to interface/reports/ippfstatistics.php. Attackers can close the string literal in the facilityid WHERE clause and use boolean or time-based payloads to read sensitive database contents.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated as a report user. The vulnerable endpoint is network-accessible, and no user interaction is required once the attacker has the required account access.
What can an attacker obtain through exploitation?
A crafted form_facility value can alter the facility_id WHERE clause using boolean or time-based SQL injection techniques. This can be used to read sensitive contents from the database; the supplied severity vector indicates no integrity or availability impact.
Which versions need remediation?
OpenEMR versions before 8.5.0 are affected. Upgrade to version 8.5.0 or later.
How can I assess whether my deployment is exposed?
Check whether the OpenEMR version is earlier than 8.5.0 and whether users have report-user access. Review requests to interface/reports/ippf_statistics.php for unusual form_facility values, particularly values containing quote characters or boolean/time-based SQL payload patterns.