Skip to content
Threat Feed
Subscribe
high advisory

OpenEMR: Authenticated SQL injection (CVE-2026-49142)

OpenEMR versions prior to 8.5.0 contain an authenticated SQL injection vulnerability in the Syndromic Surveillance module, enabling Clinician-level users to perform error-based data exfiltration and administrative account takeover.

CVE search metadata

CVE search record: CVE-2026-49142. Severity: high. CVSS: 8.8. KEV: no. Product: OpenEMR (< 8.5.0). Brief: OpenEMR: Authenticated SQL injection (CVE-2026-49142). Brief link: https://feed.craftedsignal.io/briefs/2026-10-openemr-sql-injection/

Triage facts

Revision 1
Applicability
OpenEMR (< 8.5.0)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Oct 29, 17:30 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

OpenEMR versions before 8.5.0 are vulnerable to an authenticated SQL injection flaw within the Syndromic Surveillance module. An attacker with Clinician-level privileges can manipulate the 'form_icd_codes[]' POST parameter to perform error-based exfiltration using MySQL 'extractvalue()' or execute stacked queries to modify database contents. This can lead to the theft of password hashes and complete administrative account takeover.

Impact

Successful exploitation allows authenticated users to read sensitive database contents, including bcrypt password hashes, and modify records to reset administrative accounts, leading to full system compromise.

Recommendation

  • Patch OpenEMR to version 8.5.0 or later.
  • Audit access logs for abnormal POST requests directed at the 'syndromicsurveillance/index' endpoint by users with 'Clinician' or lower privileges.
  • Monitor database error logs for occurrences of 'extractvalue()' related errors that may indicate failed or successful injection attempts.

Immediate actions

Patch OpenEMR to version 8.5.0

IT Operations 48h

Threat Hunt

Search web logs for anomalous SQL keywords in form_icd_codes parameter

T1190 high high confidence hunt now

Data: webserver access logs

Mitigations

Upgrade to OpenEMR 8.5.0

immediate IT Operations

CVE-2026-49142

Detection coverage 1

Detect CVE-2026-49142 Exploitation - SQL Injection in Syndromic Surveillance

high

Detects exploitation attempts against the Syndromic Surveillance module by monitoring POST requests to the index endpoint containing SQL injection patterns in the form_icd_codes parameter.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →