CVE-2026-124469 OpenEMR before 8.3.0 SQL Injection via Fee Sheet warehouse parameter
CriticalCVSS 9.4
EPSS 0.31%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDrug) that interpolates the prod[N][warehouse] POST field into an ORDER BY clause. Low-privileged authenticated users can submit Fee Sheet product lines with constant subqueries to run a time-based blind oracle, extracting patient data and users_secure bcrypt hashes.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openemr | < 8.3.0 | 8.3.0 |
References
- GitHub Security Advisory (GHSA-cg8c-2v5q-29g7) vendor-advisory
- VulnCheck Advisory: OpenEMR before 8.3.0 SQL Injection via Fee Sheet warehouse parameter third-party-advisory