Advisory · CVE-2026-124469
OpenEMR fee sheet SQL injection can quietly drain patient data and password hashes
OpenEMR before 8.3.0 contains SQL injection in the Fee Sheet drug-inventory lookup where DrugSalesService sellDrug interpolates the prod warehouse POST field into an ORDER BY clause, letting low-privileged authenticated users run a time-based blind oracle to extract patient data and bcrypt password hashes, rated critical at CVSS 9.9; fixed in 8.3.0.
- Vendor
- OpenEMR
- Product
- OpenEMR
- Identifier / CWE
- CVE-2026-124469
CWE-89 - Action timing
- Immediate
Explain it like I’m five
OpenEMR's fee sheet asks the database to sort drug stock, and it pastes part of the request straight into the database question. A low-privilege user can smuggle in extra questions and, by timing the answers, slowly copy out patient records and scrambled passwords.
- 01Fee Sheet opened
A low-privileged authenticated user opens a Fee Sheet product line.
- 02Crafted warehouse value
The prod warehouse POST field carries a SQL fragment.
- 03Query altered
The fragment is interpolated into the ORDER BY clause.
- 04Blind oracle runs
Constant subqueries and timing differences leak data bit by bit.
- 05Data extracted
Patient data and users_secure bcrypt hashes are recovered.
What happened
OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDrug) that interpolates the prod[N][warehouse] POST field into an ORDER BY clause. Low-privileged authenticated users can submit Fee Sheet product lines with constant subqueries to run a time-based blind oracle, extracting patient data and users_secure bcrypt hashes. The record rates it critical at CVSS 9.9 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.
A blind SQL injection is slow but thorough, and bcrypt hashes plus patient data are exactly what an attacker wants from a health record system. The flaw is fixed in OpenEMR 8.3.0.
What to do
- Inventory OpenEMR deployments and record each version.
- Upgrade to OpenEMR 8.3.0 or later.
- Review Fee Sheet and database logs for unusual ORDER BY patterns and slow queries.
- Treat extracted password hashes as compromised and force password resets for affected accounts.
- Audit patient record access in the exposure window.
- Verify the deployed version after updating.
Management note
Patient data plus password hashes out of a low-privilege account is a breach-level event. Reset credentials and check what was read, not just what version is running.