Health-Sector - CraftedSignal Threat Feed

OpenEMR: SQL injection in Fee Sheet drug-inventory lookup (CVE-2026-124469)

hello@craftedsignal.io — Sun, 08 Nov 2026 21:26:25 +0000

OpenEMR versions before 8.3.0 contain an SQL injection vulnerability in the DrugSalesService::sellDrug method. The vulnerability arises from improper sanitization of the prod[N][warehouse] POST field before it is used in an ORDER BY clause. An authenticated attacker with low privileges can leverage this flaw to perform time-based blind SQL injection attacks to exfiltrate sensitive data, such as patient records and bcrypt hashes of user credentials.

Impact

Successful exploitation allows authenticated attackers to perform unauthorized data extraction, leading to the compromise of patient PII and user authentication data (bcrypt hashes).

Recommendation

Upgrade to OpenEMR version 8.3.0 or later to address the vulnerability.
Audit access logs for abnormal POST request patterns to the DrugSalesService or Fee Sheet-related endpoints containing SQL injection syntax, particularly within the prod[N][warehouse] parameter.

OpenEMR: Missing authorization in document upload (CVE-2026-124461)

hello@craftedsignal.io — Sun, 08 Nov 2026 15:34:30 +0000

OpenEMR versions prior to 8.3.0 contain a missing authorization vulnerability in 'library/ajax/upload.php'. This flaw permits an authenticated user to perform unauthorized read and write operations on document data by manipulating the 'doc_id' parameter.

Impact

Successful exploitation allows low-privileged users to enumerate document IDs, leading to the unauthorized disclosure of patient health information (PHI) and the potential tampering of medical records across the entire installation.

Recommendation

Upgrade OpenEMR to version 8.3.0 or later to remediate the authorization logic flaw.
Implement strict access control monitoring for requests directed to 'library/ajax/upload.php'.
Review application access logs for abnormal volumes of requests to the document upload endpoint, specifically those targeting sequential or unusual 'doc_id' values.

OpenEMR: Stored cross-site scripting in CCDA/CCD preview (CVE-2026-124448)

hello@craftedsignal.io — Sun, 08 Nov 2026 15:31:55 +0000

OpenEMR versions prior to 8.3.0 contain stored cross-site scripting (XSS) vulnerabilities within the CCDA/CCD preview stylesheets. Specifically, the cda.xsl and ccd.xsl files fail to properly sanitize input, allowing event-handler attributes such as onmouseover, onclick, and onfocus to be injected into previewed HTML. An authenticated attacker can upload a crafted CCDA/CCD document containing these malicious handlers to execute unauthorized JavaScript in the context of a clinician's session.

Impact

Successful exploitation allows authenticated attackers to execute arbitrary JavaScript within a clinician's session, potentially leading to unauthorized data access, session hijacking, or other actions performed with the clinician's privileges within the OpenEMR application.

Recommendation

Upgrade OpenEMR to version 8.3.0 or later to apply the fix for CVE-2026-124448.
Implement Content Security Policy (CSP) headers that restrict inline script execution to reduce the impact of XSS vulnerabilities.
Audit access logs for user accounts uploading CCDA/CCD documents to identify potential abuse of the file upload functionality.