Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) layoutid parameter to interface/super/editlayout.php; (2) formpatientid, (3) formdrugname, or (4) formlotnumber parameter to interface/reports/prescriptionsreport.php; (5) paymentid parameter to interface/billing/editpayment.php; (6) id parameter to interface/formsadmin/formsadmin.php; (7) formpid or (8) formencounter parameter to interface/billing/sleobsearch.php; (9) sortby parameter to interface/logview/logview.php; formfacility parameter to (10) procedurestats.php, (11) pendingfollowup.php, or (12) pendingorders.php in interface/orders/; (13) patient, (14) encounterid, (15) formid, or (16) issue parameter to interface/patientfile/deleter.php; (17) searchterm parameter to interface/patientfile/encounter/codingpopup.php; (18) text parameter to interface/patientfile/encounter/searchcode.php; (19) formaddr1, (20) formaddr2, (21) formattn, (22) formcountry, (23) formfreebtype, (24) formpartner, (25) formname, (26) formzip, (27) formstate, (28) formcity, or (29) formcmsid parameter to interface/practice/inssearch.php; (30) formpid parameter to interface/patientfile/problemencounter.php; (31) patient, (32) formprovider, (33) formapptstatus, or (34) formfacility parameter to interface/reports/appointmentsreport.php; (35) dbid parameter to interface/patientfile/summary/demographicssave.php; (36) p parameter to interface/fax/faxdispatchnewpid.php; or (37) patientid parameter to interface/patientfile/reminder/patientreminders.php.