CVE-2026-126478
Awaiting Analysis Awaiting Analysis - Queue

SQL Injection in OpenEMR Prior to 8.5.0

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenEMR before 8.5.0 contains an SQL injection vulnerability in the Syndromic Surveillance report because the form_icd_codes[] POST array is concatenated into an unquoted numeric IN() clause without integer validation. Authenticated users can submit quote-free payloads that bypass add_escape_custom to perform blind or UNION-based injection and exfiltrate patient health information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126478
EUVD
EUVD-2026-124946

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in OpenEMR versions before 8.5.0. It affects the Syndromic Surveillance report module where the form_icd_codes[] POST array is directly embedded into an SQL query without proper sanitization. The application's input sanitization function add_escape_custom is ineffective against quote-free payloads in a numeric context, allowing authenticated users to inject malicious SQL code into the IN() clause.

Detection Guidance

To detect this vulnerability, check if OpenEMR versions prior to 8.5.0 are installed and if the Syndromic Surveillance module is enabled. Review web server logs for suspicious POST requests to the Syndromic Surveillance report endpoint containing form_icd_codes[] parameters with quote-free payloads or SQL keywords like OR, SLEEP, UNION, or --.

Impact Analysis

An attacker could exploit this to perform blind or UNION-based SQL injection attacks. This may lead to unauthorized access and exfiltration of protected patient health information. The vulnerability requires the Syndromic Surveillance module to be enabled and affects versions up to 8.2.0.

Compliance Impact

This vulnerability could lead to unauthorized access and exfiltration of protected health information, which directly violates compliance requirements under HIPAA for patient data protection. GDPR may also be impacted if EU patient data is involved, as unauthorized access breaches data protection principles.

Mitigation Strategies
  • Upgrade OpenEMR to version 8.5.0 or later to address the SQL injection flaw.
  • Disable the Syndromic Surveillance module if not required, as it is non-default and a prerequisite for exploitation.
  • Implement strict input validation for form_icd_codes[] by casting values to integers or using parameterized queries.
  • Monitor database queries for unusual activity, especially UNION-based or time-delayed queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126478. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...