CVE-2026-126489: OpenEMR before 8.5.0 SQL Injection via IPPF Contraceptive Issue Feature
OpenEMR before 8.5.0 contains a second-order SQL injection vulnerability in the IPPF contraceptive issue feature because issueippfconsave concatenates layoutoptions fieldid values into a REPLACE INTO query as column names. Authenticated administrators can add a malicious fieldid via editlayout.php, then trigger issueippfconsave through addeditissue.php to execute arbitrary SQL.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated OpenEMR administrator is required. The attacker must be able to use edit_layout.php to create a malicious layout_options field_id value and then invoke issue_ippf_con_save through add_edit_issue.php.
Are deployments running OpenEMR 8.5.0 affected?
No. The issue is reported to affect OpenEMR versions before 8.5.0.
What is the impact if exploitation succeeds?
The attacker can execute arbitrary SQL. The reported impact includes high confidentiality, integrity, and availability consequences.