SQL Injection in OpenEMR Patient Portal API

Executive Summary

This is a SQL injection vulnerability in OpenEMR versions before 8.5.0. It exists in the patient portal's api/onsiteactivityviews endpoint where unquoted Id_BitwiseAnd Criteria values allow authenticated staff users to inject malicious SQL code. Attackers can close bitwise parentheses and append OR or UNION SELECT clauses to access sensitive data like patient PHI, staff password hashes, MySQL authentication strings, and API tokens.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect OpenEMR logs for suspicious SQL queries in the patient portal's api/onsiteactivityviews endpoint. Look for patterns like appended OR or UNION SELECT clauses. Check for unauthorized access to sensitive tables such as patient PHI, staff password hashes, or MySQL authentication strings.

Useful 0 Not Useful 0

Impact Analysis

If you are an OpenEMR user running versions before 8.5.0, an attacker with staff access could exploit this to steal patient health information, staff credentials, database credentials, and API tokens. This could lead to identity theft, unauthorized data access, or further network compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to patient PHI. GDPR requires protection of personal data while HIPAA mandates safeguards for protected health information. A breach could result in legal penalties, fines, and reputational damage for organizations handling such data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.5.0 or later to patch the SQL injection flaw. If upgrading is not possible, apply input validation to sanitize Id_BitwiseAnd Criteria values and enforce strict access controls on the api/onsiteactivityviews endpoint.

Useful 0 Not Useful 0