OpenEMR Second-Order SQL Injection in IPPF Contraceptive Issue Feature

Executive Summary

This is a second-order SQL injection vulnerability in OpenEMR versions before 8.5.0. It exists in the IPPF contraceptive issue feature where the issue_ippf_con_save function concatenates layout_options field_id values directly into a REPLACE INTO query as column names without proper sanitization. Authenticated administrators can exploit this by inserting malicious field_id values via edit_layout.php and triggering the vulnerable code through add_edit_issue.php to execute arbitrary SQL commands.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect OpenEMR versions prior to 8.5.0 for the IPPF contraceptive issue feature. Check for unauthorized modifications in the layout_options table via edit_layout.php and trace SQL queries involving issue_ippf_con_save in add_edit_issue.php. Look for suspicious field_id values in database logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker with administrative access could exploit this to execute arbitrary SQL queries, leading to unauthorized database access, data breaches of sensitive medical information, server-side code execution, and full database compromise. The impact includes potential theft or manipulation of patient records, system takeover, and disruption of healthcare services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to protected health information (PHI). GDPR requires strict data protection and breach notification, while HIPAA mandates safeguards for electronic protected health information (ePHI). A successful exploit could result in regulatory penalties, legal liabilities, and loss of patient trust due to compromised sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenEMR to version 8.5.0 or later. If upgrading is not possible, restrict administrative access to edit_layout.php and add_edit_issue.php. Review database logs for signs of exploitation and remove any unauthorized field_id entries in the layout_options table.

Useful 0 Not Useful 0