CVE-2026-124469
Received Received - Intake

SQL Injection in OpenEMR Fee Sheet via Drug-Inventory Lookup

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDrug) that interpolates the prod[N][warehouse] POST field into an ORDER BY clause. Low-privileged authenticated users can submit Fee Sheet product lines with constant subqueries to run a time-based blind oracle, extracting patient data and users_secure bcrypt hashes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124469
EUVD
EUVD-2026-119525

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in OpenEMR versions before 8.3.0. It exists in the Fee Sheet drug-inventory lookup function where the prod[N][warehouse] POST parameter is directly interpolated into an ORDER BY SQL clause without sanitization. Low-privileged authenticated users can inject constant subqueries to perform time-based blind SQL injection, allowing extraction of patient data and bcrypt hashes from the users_secure table.

Detection Guidance

To detect this vulnerability, monitor for unusual SQL query patterns in application logs, particularly those involving the Fee Sheet drug-inventory lookup. Check for POST requests to DrugSalesService.php with prod[N][warehouse] parameters containing SQL-like syntax such as subqueries or time delays. Use network traffic analysis tools to inspect HTTP POST requests for suspicious payloads.

Impact Analysis

An attacker with low-level authenticated access can exploit this to extract sensitive patient data and bcrypt password hashes. This enables full account takeover through offline cracking of hashes. The attack requires minimal privileges and can be executed with a single authenticated POST request per bit of data extracted.

Compliance Impact

This vulnerability severely impacts compliance with GDPR and HIPAA due to unauthorized access to sensitive patient data and potential exposure of protected health information. It compromises data confidentiality and integrity, leading to potential regulatory penalties and legal consequences for non-compliance.

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.3.0 or later. Apply input validation to sanitize the prod[N][warehouse] POST parameter before database queries. Replace direct SQL interpolation with parameterized queries in DrugSalesService.php. Implement CSRF protection to prevent unauthorized POST requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124469. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...