OpenEMR (< 8.5.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/openemr--8.5.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 17:30:52 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenEMR: Authenticated SQL injection (CVE-2026-49142)https://feed.craftedsignal.io/briefs/2026-10-openemr-sql-injection/Thu, 29 Oct 2026 17:30:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-openemr-sql-injection/OpenEMR versions prior to 8.5.0 contain an authenticated SQL injection vulnerability in the Syndromic Surveillance module, enabling Clinician-level users to perform error-based data exfiltration and administrative account takeover.OpenEMR versions before 8.5.0 are vulnerable to an authenticated SQL injection flaw within the Syndromic Surveillance module. An attacker with Clinician-level privileges can manipulate the 'form_icd_codes[]' POST parameter to perform error-based exfiltration using MySQL 'extractvalue()' or execute stacked queries to modify database contents. This can lead to the theft of password hashes and complete administrative account takeover.

Impact

Successful exploitation allows authenticated users to read sensitive database contents, including bcrypt password hashes, and modify records to reset administrative accounts, leading to full system compromise.

Recommendation

  • Patch OpenEMR to version 8.5.0 or later.
  • Audit access logs for abnormal POST requests directed at the 'syndromicsurveillance/index' endpoint by users with 'Clinician' or lower privileges.
  • Monitor database error logs for occurrences of 'extractvalue()' related errors that may indicate failed or successful injection attempts.
]]>highadvisory