GHSA-pc2q-9pcw-v899: OpenEMR before 8.5.0 SQL Injection via getByPatientDemographics in patient.inc.php
OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in getByPatientDemographics() where layoutoptions fieldid values are concatenated into the patient search WHERE clause. Attackers with Layout Editor access can plant a malicious fieldid, allowing any authenticated low-privilege user to exfiltrate data from patientdata and userssecure tables.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
OpenEMR deployments where a user has Layout Editor access are exposed, because that access can be used to plant a malicious layout_options field_id. After the payload is planted, any authenticated low-privilege user can trigger data exfiltration.
What access does an attacker need?
An attacker needs Layout Editor access to introduce the malicious field_id. Exploitation also relies on an authenticated low-privilege user being able to use the affected patient search path.
What information can be exposed?
The vulnerability can be used to exfiltrate data from the patient_data and users_secure tables.
Which versions are affected?
OpenEMR versions before 8.5.0 are affected.