OpenEMR Second-Order SQL Injection Vulnerability

Executive Summary

OpenEMR before version 8.5.0 has a second-order SQL injection flaw. Low-privileged authenticated users can inject malicious SQL via library/ajax/addlistitem.php. The attack stores a SQL fragment in the recent_patient_columns option_id value, which later gets concatenated into a SELECT query in dynamic_finder.php and executed.

Useful 0 Not Useful 0

Detection Guidance

Check OpenEMR version for versions before 8.5.0. Inspect recent_patient_columns option_id values in the database for malicious SQL fragments. Review dynamic_finder.php for improper SQL concatenation.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read, modify, or delete sensitive patient data in the OpenEMR database. They might also gain unauthorized access to other system functions depending on database permissions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of protected health information (PHI), violating HIPAA requirements for safeguarding patient data. It may also result in GDPR non-compliance if EU patient data is involved, as it could lead to unauthorized processing or breaches of personal data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenEMR to version 8.5.0 or later. Remove any suspicious SQL fragments from recent_patient_columns. Audit database queries for improper concatenation in dynamic_finder.php.

Useful 0 Not Useful 0