CVE-2026-126492: OpenEMR before 8.5.0 Second-Order SQL Injection via dynamic_finder.php
OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows low-privileged authenticated users to store malicious SQL via library/ajax/addlistitem.php. Attackers can persist a SQL fragment in the recentpatientcolumns optionid value, which dynamicfinder.php concatenates into a SELECT query and executes as SQL.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated OpenEMR account with low privileges. No user interaction is required after the attacker stores the malicious value.
Which component and stored value should be investigated for signs of exploitation?
Investigate requests to library/ajax/addlistitem.php and review stored option_id values associated with recent_patient_columns. The vulnerable path occurs when dynamic_finder.php later concatenates that stored value into a SELECT query.
What is the fixed version?
The issue affects OpenEMR versions before 8.5.0. Upgrade to version 8.5.0 or later.