{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-33910/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.0.0.3)"],"_cs_severities":["high"],"_cs_tags":["sqli","openemr","cve-2026-33910","healthcare"],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR, a widely-used open-source electronic health records and medical practice management application, is vulnerable to SQL injection. Specifically, versions up to and including 8.0.0.2 contain a flaw in the patient selection feature (CVE-2026-33910). Authenticated attackers with valid user credentials can exploit this vulnerability due to insufficient input validation. Successful exploitation allows attackers to execute arbitrary SQL queries, potentially leading to unauthorized access, modification, or deletion of sensitive patient data. OpenEMR version 8.0.0.3 addresses this vulnerability with a patch. This vulnerability poses a significant risk to healthcare providers and their patients, potentially leading to data breaches, compliance violations, and reputational damage.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains valid credentials for an OpenEMR user account.\u003c/li\u003e\n\u003cli\u003eThe attacker logs into the OpenEMR application.\u003c/li\u003e\n\u003cli\u003eThe attacker navigates to the patient selection feature within the application.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious SQL query and injects it into the input fields of the patient selection form.\u003c/li\u003e\n\u003cli\u003eThe application executes the attacker-controlled SQL query against the database.\u003c/li\u003e\n\u003cli\u003eThe attacker retrieves sensitive patient data, such as personal information, medical history, and insurance details.\u003c/li\u003e\n\u003cli\u003eThe attacker modifies patient records, potentially altering medical diagnoses or treatment plans.\u003c/li\u003e\n\u003cli\u003eThe attacker exfiltrates the stolen data or uses it for malicious purposes, like identity theft or fraud.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this SQL injection vulnerability (CVE-2026-33910) could result in a significant data breach, potentially affecting thousands of patients. The healthcare sector is a prime target for cyberattacks due to the sensitive nature of the data it holds. A successful attack could lead to regulatory fines, legal action, and a loss of trust from patients and the community. The impact includes unauthorized access to Electronic Health Records (EHR), potential modification of medical information, and exfiltration of Protected Health Information (PHI).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade all OpenEMR installations to version 8.0.0.3 or later to patch the SQL injection vulnerability (CVE-2026-33910).\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules provided in this brief to detect potential exploitation attempts against the patient selection feature.\u003c/li\u003e\n\u003cli\u003eImplement input validation and sanitization measures for all user-supplied data within the OpenEMR application to prevent future SQL injection vulnerabilities.\u003c/li\u003e\n\u003cli\u003eReview and enforce strong authentication and authorization policies for all OpenEMR user accounts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T00:05:57Z","date_published":"2026-03-26T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2026-03-openemr-sqli/","summary":"OpenEMR versions up to 8.0.0.2 are vulnerable to SQL injection in the patient selection feature, which can be exploited by authenticated attackers due to insufficient input validation, potentially leading to unauthorized data access and modification.","title":"OpenEMR SQL Injection Vulnerability (CVE-2026-33910)","url":"https://feed.craftedsignal.io/briefs/2026-03-openemr-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-33910","version":"https://jsonfeed.org/version/1.1"}