Second-Order SQL Injection in OpenEMR

Executive Summary

OpenEMR before version 8.5.0 has a second-order SQL injection flaw in the Carecoordination CCDA Mapper. Authenticated Carecoordination users can inject malicious SQL into C-CDA field identifiers via the savedata action. This stored input is later used in an SQL IN clause during C-CDA generation, allowing attackers to extract sensitive data like password hashes, portal reset values, and patient records.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your OpenEMR version is below 8.5.0. Review Carecoordination CCDA Mapper logs for suspicious SQL-like input in C-CDA field identifiers. Monitor database queries for unusual IN clause patterns during C-CDA generation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to extract sensitive data such as patient records, staff password hashes, and portal reset values. An active reset value could lead to patient-portal account takeover. Delay expressions in SQL could also degrade application availability.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.5.0 or later. Disable Carecoordination and C-CDA generation features if not required. Review and restrict access to Carecoordination users. Monitor for unauthorized data extraction attempts.

Useful 0 Not Useful 0