OpenEMR has SQL Injection in Patient API Sort Parameter

An attacker exploiting this SQL injection vulnerability could gain unauthorized access to the OpenEMR database. Successful exploitation could lead to the exposure of Protected Health Information (PHI), including patient records, medical history, and personal details. Furthermore, an attacker might be able to compromise user credentials, potentially gaining administrative access to the system. The potential for data breaches and regulatory non-compliance makes this a high-impact vulnerability. The ability to execute arbitrary SQL queries provides a broad attack surface, allowing for data exfiltration, modification, or even complete database takeover.

Healthcare providers and organizations utilizing OpenEMR, particularly those relying on the Patient REST API for data access and integration, are at significant risk. Shared hosting environments where multiple OpenEMR instances reside on the same server are also vulnerable, as a compromise of one instance could potentially impact others.

• linux / server:

journalctl -u openemr | grep -i "SQL injection"

• generic web:

curl -I 'https://<openemr_host>/api/patient?_sort='; # Check for unusual response headers or errors

• database (mysql):

mysql -u <openemr_user> -p -e "SHOW TABLES LIKE 'patient%';"

1. 2026-02-25Disclosure

   disclosure

2. 2026-02-25Patch

   patch

1. Reserviert2026-01-27
2. Veröffentlicht2026-02-25
3. Geändert2026-02-26
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-24908 is to upgrade OpenEMR to version 8.0.0 or later, which includes the necessary fix. If immediate upgrading is not possible, consider implementing temporary workarounds such as restricting API access to authorized users only and carefully reviewing and validating all user inputs. Web application firewalls (WAFs) configured to detect and block SQL injection attempts can also provide an additional layer of defense. Monitor OpenEMR logs for suspicious SQL queries and unusual database activity.