CVE-2026-126482
Awaiting Analysis Awaiting Analysis - Queue

SQL Injection in OpenEMR Prior to 8.5.0

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber() in src/Billing/SLEOB.php, which concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into a query without escaping or parameter binding. Authenticated users with billing permissions, or a malicious payer whose ERA file a clerk uploads, can execute arbitrary SQL to read any table, including users_secure password hashes, and modify data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126482
EUVD
EUVD-2026-124942

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR before version 8.5.0 has an SQL injection flaw in the SLEOB::slInvoiceNumber() function. This function processes X12 835 ERA files and directly concatenates the CLP01 claim identifier into a database query without proper escaping or parameter binding. Attackers with billing permissions or malicious payers (if their ERA file is uploaded by a clerk) can exploit this to run arbitrary SQL commands, allowing them to read sensitive data like password hashes or modify database contents.

Detection Guidance

Detecting this SQL injection vulnerability requires checking for unauthorized database access or suspicious queries in OpenEMR logs. Look for unusual patterns in SQL queries involving SLEOB::slInvoiceNumber() or CLP01 claim identifiers. Review X12 835 ERA files for malformed or unexpected data in the CLP01 field. Enable database query logging if not already active to monitor for suspicious activity.

Impact Analysis

If you use OpenEMR versions before 8.5.0, an attacker could gain access to sensitive information such as user passwords or modify critical data in the system. This could lead to unauthorized access, data breaches, or system manipulation, affecting both patient and administrative data integrity.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access or exposure of sensitive personal data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach could result in legal penalties, fines, and reputational damage for organizations handling such data.

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.5.0 or later to patch the vulnerability. If upgrading is not possible, restrict access to billing permissions for authenticated users and validate all X12 835 ERA files before processing. Disable or closely monitor SQL query execution for SLEOB::slInvoiceNumber() until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126482. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...