CVE-2026-124468OpenEMR before 8.3.0 SQL Injection via Patient Insurance and Employer REST API

Açıklama

OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names into SQL as column identifiers without escaping. Authenticated clients, including low-privilege patient-portal OAuth2 tokens, can send crafted parameter names to /api/patient/{puuid}/insurance or /api/patient/{puuid}/employer to extract patient PHI, user records, and API client secrets.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-fhc4-8f9p-8mcc) vendor-advisory
• Patch Commit patch
• VulnCheck Advisory: OpenEMR before 8.3.0 SQL Injection via Patient Insurance and Employer REST API third-party-advisory