critical advisory November 8, 2026

OpenEMR: SQL injection in Fee Sheet drug-inventory lookup (CVE-2026-124469)

OpenEMR versions prior to 8.3.0 are susceptible to time-based blind SQL injection in the Fee Sheet component, allowing low-privileged authenticated users to exfiltrate patient data and user hashes.

Triage facts

Revision 1

Applicability: OpenEMR (< 8.3.0)
Evidence: Unknown
Severity: Critical
Action: Elevated
Sources: 1 public source
Freshness: Revision 1Nov 8, 21:26 UTC
Vulnerabilities: 1 CVE
Source quality: A1Likely

OpenEMR versions before 8.3.0 contain an SQL injection vulnerability in the DrugSalesService::sellDrug method. The vulnerability arises from improper sanitization of the prod[N][warehouse] POST field before it is used in an ORDER BY clause. An authenticated attacker with low privileges can leverage this flaw to perform time-based blind SQL injection attacks to exfiltrate sensitive data, such as patient records and bcrypt hashes of user credentials.

Impact

Successful exploitation allows authenticated attackers to perform unauthorized data extraction, leading to the compromise of patient PII and user authentication data (bcrypt hashes).

Recommendation

Upgrade to OpenEMR version 8.3.0 or later to address the vulnerability.
Audit access logs for abnormal POST request patterns to the DrugSalesService or Fee Sheet-related endpoints containing SQL injection syntax, particularly within the prod[N][warehouse] parameter.

Immediate actions

Patch OpenEMR to version 8.3.0 or later

IT Operations 48h

Threat Hunt

Identify authenticated sessions performing frequent, time-delayed POST requests to drug-inventory lookup endpoints

T1190 high medium confidence hunt now

Data: Web server logs (access and error logs), Application-level auditing of the Fee Sheet module

Mitigations

Upgrade OpenEMR to 8.3.0

immediate IT Operations

CVE-2026-124469