Summary
generated automatically from NVD dataOpenEMR versions before 8.5.0 have an authenticated SQL injection (CWE-89) in the Syndromic Surveillance module. A user with Clinician-level privileges can send crafted values in the form_icd_codes[] POST parameter to the syndromicsurveillance/index endpoint, injecting into an unquoted numeric IN() clause. This lets the attacker read and modify database contents, including extracting bcrypt password hashes via MySQL extractvalue() and running stacked queries that reset passwords, leading to full administrative account takeover. The CVSS v3.1 score is 8.8 (HIGH).
NVD description
OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values in the form_icd_codes[] POST parameter to the syndromicsurveillance/index endpoint. Attackers can inject an unquoted numeric IN() clause and UNION DISTINCT SELECT statement using hex-encoded literals to abuse MySQL extractvalue() for error-based exfiltration of bcrypt password hashes and execute stacked queries that reset passwords, resulting in full administrative account takeover.
EPSS · FIRST.org
0.36%probability of exploitation in the next 30 days
Higher than 29% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-30, recomputed daily by FIRST.org.
CVSS v3.1 Score
Information
- Published
- 29 oct. 2026
- Updated
- 29 oct. 2026
- Status
- Awaiting Analysis
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
References (5)
Similar CVEs
Other vulnerabilities of type CWE-89
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.