CVE-2026-39931 in OpenEMR
Summary
by MITRE • 08/03/2026
OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the form_step=202 parameter in backup.php. Attackers can exploit the unfiltered shell_exec invocation of the mysql command-line client to extract credential hashes, modify access control tables, inject backdoor accounts, create persistent triggers or stored procedures, and write arbitrary files to the filesystem where MySQL FILE privileges and permissive secure_file_priv settings are configured.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability exists within the OpenEMR medical records system version 8.2.0 and earlier, representing a critical authenticated SQL injection flaw that can be exploited by users possessing administrative privileges. The vulnerability specifically resides in the backup configuration import functionality where the application fails to properly sanitize user-supplied input during the processing of SQL files. When administrators upload specially crafted SQL files through the form_step=202 parameter in backup.php, the application directly invokes shell_exec with unfiltered user data, creating a direct pathway for command injection attacks that bypass traditional input validation mechanisms.
The technical implementation of this vulnerability stems from improper input sanitization and unsafe execution practices within the backup import module. The mysql command-line client is invoked without adequate filtering or escaping of user-provided content, allowing attackers to inject malicious SQL commands that get executed with the privileges of the database user account. This flaw aligns with CWE-89 which categorizes SQL injection vulnerabilities as a result of insufficient input validation and improper output encoding. The vulnerability operates at the intersection of command injection and SQL injection attacks since it leverages shell execution to pass user-controlled parameters directly to the database engine.
The operational impact of this vulnerability is severe and multifaceted, enabling attackers with administrative access to perform arbitrary database operations that can completely compromise the integrity and confidentiality of medical records. Attackers can extract credential hashes from database tables, modify access control mechanisms to maintain persistent access, inject backdoor accounts that bypass normal authentication procedures, create malicious triggers or stored procedures that execute code automatically upon database events, and write files to the filesystem when MySQL FILE privileges are enabled. This capability directly maps to several MITRE ATT&CK techniques including T1078 for valid accounts, T1046 for network service scanning, T1566 for credential access, and T1059 for command and scripting interpreter.
Organizations affected by this vulnerability should immediately implement mitigations including restricting administrative privileges to only essential personnel, implementing strict input validation controls for all backup import processes, disabling unnecessary MySQL FILE privileges, configuring secure_file_priv settings to limit file system write operations, and monitoring database activities for suspicious command execution patterns. Additionally, the application should be updated to versions that properly sanitize user input before passing it to shell execution functions, implement proper parameter binding for database queries, and establish comprehensive logging of backup import activities for security monitoring purposes. The vulnerability demonstrates the critical importance of secure coding practices in web applications and highlights the dangers of direct shell command invocation with unsanitized user data.