OpenEMR में रोगी API सॉर्ट पैरामीटर में SQL इंजेक्शन (SQL Injection) है

The SQL injection vulnerability in OpenEMR allows authenticated users with API access to bypass security controls and directly manipulate the database. An attacker could leverage this to extract Protected Health Information (PHI), including patient records, medical history, and billing details. Furthermore, successful exploitation could lead to credential compromise, allowing the attacker to gain persistent access to the OpenEMR system and potentially escalate privileges. The potential for data breaches and regulatory non-compliance makes this a high-impact vulnerability, particularly given the sensitive nature of healthcare data.

Healthcare providers and organizations utilizing OpenEMR, particularly those relying on the Patient REST API for data access and integration, are at significant risk. Shared hosting environments where multiple OpenEMR instances reside on the same server are also vulnerable, as a compromise of one instance could potentially impact others.

• linux / server:

journalctl -u openemr | grep -i "SQL injection"

• generic web:

curl -I 'https://<openemr_host>/api/patient?_sort='; # Check for unusual response headers or errors

• database (mysql):

mysql -u <openemr_user> -p -e "SHOW TABLES LIKE 'patient%';"

1. 2026-02-25Disclosure

   disclosure

2. 2026-02-25Patch

   patch

1. आरक्षित2026-01-27
2. प्रकाशित2026-02-25
3. संशोधित2026-02-26
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2026-24908 is to upgrade OpenEMR to version 8.0.0 or later, which includes the necessary fix. If immediate upgrading is not possible, consider implementing temporary workarounds such as restricting API access to authorized users only and carefully validating all user-supplied input. Web Application Firewalls (WAFs) configured to detect and block SQL injection attempts can also provide an additional layer of defense. After upgrading, confirm the fix by attempting to inject a simple SQL query through the Patient REST API endpoint and verifying that it is properly sanitized.