CVE-2026-126483
Awaiting Analysis Awaiting Analysis - Queue

SQL Injection in OpenEMR Before 8.5.0

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
OpenEMR before 8.5.0 contains an SQL injection vulnerability that allows authenticated report users to manipulate queries by supplying a crafted form_facility value to interface/reports/ippf_statistics.php. Attackers can close the string literal in the facility_id WHERE clause and use boolean or time-based payloads to read sensitive database contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126483
EUVD
EUVD-2026-124941

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openemr openemr to 8.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

OpenEMR versions before 8.5.0 have an SQL injection flaw in the report generation feature. Authenticated users with report access can inject malicious SQL queries via the form_facility parameter in interface/reports/ippf_statistics.php. This allows attackers to manipulate the facility_id filter in the WHERE clause, potentially accessing or altering sensitive database information.

Detection Guidance

To detect this SQL injection vulnerability in OpenEMR, inspect network traffic for requests to interface/reports/ippf_statistics.php with unusual form_facility parameters. Check server logs for malformed SQL queries or boolean/time-based payloads in facility_id values. Use tools like SQLmap to test for injection points in authenticated report user sessions.

Impact Analysis

If you use OpenEMR versions before 8.5.0, an attacker with report access could extract sensitive patient or operational data from your database. They might also modify or delete records, disrupting system functionality. The impact depends on the database contents and attacker's goals.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of protected health information (PHI), violating HIPAA requirements for safeguarding patient data. It may also result in GDPR breaches if personal data of EU citizens is compromised, potentially leading to fines or legal consequences.

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.5.0 or later to patch the SQL injection flaw. If upgrading is not possible, restrict access to interface/reports/ippf_statistics.php for non-admin users and implement input validation for form_facility parameters to prevent malicious payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126483. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...