CVE-2026-49142: SQL Injection
OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values in the formicdcodes[] POST parameter to the syndromicsurveillance/index endpoint. Attackers can inject an unquoted numeric IN() clause and UNION DISTINCT SELECT statement using hex-encoded literals to abuse MySQL extractvalue() for error-based exfiltration of bcrypt password hashes and execute stacked queries that reset passwords, resulting in full administrative account takeover.
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs an authenticated OpenEMR account with Clinician-level privileges. No user interaction is required after the attacker is authenticated.
Which systems are affected?
OpenEMR versions before 8.5.0 are affected. The vulnerable functionality is the Syndromic Surveillance module, specifically requests to the syndromicsurveillance/index endpoint using the form_icd_codes[] POST parameter.
What could an attacker do with successful exploitation?
A Clinician-level attacker can read and modify arbitrary database contents. The issue can be used to extract bcrypt password hashes and reset passwords through stacked queries, enabling takeover of an administrative account.
What is the recommended remediation?
Upgrade OpenEMR to version 8.5.0 or later. The issue is addressed in the 8.5.0 release.