Authenticated SQL Injection in OpenEMR Affecting Clinician Privileges

CVE-2026-49142

What is CVE-2026-49142?

OpenEMR versions prior to 8.5.0 are susceptible to an authenticated SQL injection vulnerability located in the Syndromic Surveillance module. This vulnerability permits users with Clinician-level privileges to manipulate database content through specially crafted inputs submitted via the form_icd_codes[] POST parameter on the syndromicsurveillance/index endpoint. Attackers can exploit this flaw by injecting unquoted numeric IN() clauses and utilizing UNION DISTINCT SELECT statements with hex-encoded literals, leveraging MySQL's extractvalue() function for error-based exfiltration of sensitive data, including bcrypt password hashes. Furthermore, the vulnerability allows execution of stacked queries that can reset passwords, facilitating an entire administrative account takeover, thus posing a significant security risk to affected installations.

References