SQL Injection in OpenEMR REST API

Executive Summary

OpenEMR before version 8.3.0 has a SQL injection flaw in its Standard REST API. The vulnerability occurs in patient insurance and employer search endpoints where query-string parameter names are directly concatenated into SQL queries as column identifiers without proper escaping. This allows authenticated users, including those with low-privilege OAuth2 tokens, to inject malicious SQL commands.

Useful 0 Not Useful 0

Detection Guidance

To detect this SQL injection vulnerability in OpenEMR, monitor API logs for suspicious requests to /api/patient/{puuid}/insurance or /api/patient/{puuid}/employer endpoints. Look for unusual query parameters or SQL-like syntax in parameter names. Use tools like SQLMap to test endpoints for injection flaws. Check for unauthorized data access patterns in database logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to extract sensitive patient Protected Health Information (PHI), user records, and API client secrets from the database. Since low-privilege OAuth2 tokens can be used, even patients or basic users might pose a risk if they have access to the API.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to PHI. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach could result in legal penalties, fines, and reputational damage for organizations using affected OpenEMR versions.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.3.0 or later to patch the vulnerability. If upgrading is not immediately possible, restrict access to the vulnerable endpoints by implementing strict authentication and authorization controls. Disable low-privilege OAuth2 tokens for patient portal users until patched. Monitor network traffic for exploitation attempts targeting these endpoints.

Useful 0 Not Useful 0