OpenEMR up to 8.4.x Syndromic Surveillance form_icd_codes[] sql injection

Summaryinfo

A vulnerability, which was classified as critical, was found in OpenEMR up to 8.4.x. This affects an unknown part of the component Syndromic Surveillance. Executing a manipulation of the argument form_icd_codes[] can lead to sql injection. This vulnerability is registered as CVE-2026-126478. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in OpenEMR up to 8.4.x and classified as critical. This vulnerability affects some unknown functionality of the component Syndromic Surveillance. The manipulation of the argument form_icd_codes[] with an unknown input leads to a sql injection vulnerability. The CWE definition for the vulnerability is CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

OpenEMR before 8.5.0 contains an SQL injection vulnerability in the Syndromic Surveillance report because the form_icd_codes[] POST array is concatenated into an unquoted numeric IN() clause without integer validation. Authenticated users can submit quote-free payloads that bypass add_escape_custom to perform blind or UNION-based injection and exfiltrate patient health information.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-126478 since 11/10/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1505.

Upgrading to version 8.5.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Business Process Management Software

Name

• OpenEMR

Version

• 8.0
• 8.1
• 8.2
• 8.3
• 8.4

License

• open-source

Website

• Product: https://github.com/openemr/openemr/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion