SQL Injection Vulnerability in OpenEMR's Fee Sheet Drug Inventory Lookup

CVE-2026-124469

What is CVE-2026-124469?

OpenEMR prior to version 8.3.0 is vulnerable to SQL injection within the Fee Sheet drug inventory lookup feature. This vulnerability allows low-privileged authenticated users to exploit the application by injecting malicious SQL queries through the prod[N][warehouse] POST parameter. By leveraging constant subqueries, attackers can perform a time-based blind oracle attack, potentially exposing sensitive patient data and secure user bcrypt hashes. It is crucial for users of affected versions to apply necessary updates to mitigate risks associated with this vulnerability.

References