SQL Injection in OpenEMR Prior to 8.5.0

Executive Summary

This is a SQL injection vulnerability in OpenEMR versions before 8.5.0. Authenticated core users can inject malicious SQL code by manipulating patient_data field names in the CCR revandapprove controller. Attackers can execute scalar subqueries in an UPDATE statement to read sensitive data like staff password hashes or modify patient demographics.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your OpenEMR instance is running a version before 8.5.0. Review logs for suspicious SQL queries in the CCR revandapprove controller, particularly those involving patient_data field names. Look for unauthorized modifications to patient demographics or unexpected database access patterns.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal staff password hashes and portal reset values, alter patient records, or take over patient-portal accounts. The exploit requires only a standard authenticated account and no special permissions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance with GDPR and HIPAA due to unauthorized access to sensitive patient data and potential data breaches. It compromises confidentiality and integrity of protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.5.0 or later to patch the vulnerability. If upgrading is not immediately possible, restrict access to the CCR revandapprove controller and monitor for unusual SQL injection attempts. Ensure all authenticated users follow least-privilege principles.

Useful 0 Not Useful 0