A SQL injection vulnerability in OpenEMR versions prior to 8.0.0 allows authenticated attackers to compromise the application database, posing a high risk to sensitive medical data.

This is a SQL injection vulnerability (CWE-89) located in the prescription module of OpenEMR. An attacker with authenticated access can exploit insufficient input validation within the prescription listing functionality to execute unauthorized SQL commands.

The ability to perform SQL injection attacks poses a severe threat to the integrity, confidentiality, and availability of patient health records. Given the CVSS score of 8.8, this vulnerability is classified as High, as it could allow an attacker to exfiltrate sensitive data, modify medical records, or disrupt clinical operations. Unauthorized database access in a medical environment often leads to regulatory non-compliance and significant reputational harm.

Immediate Action: Upgrade OpenEMR to version 8.0.0 or later immediately to incorporate the necessary input validation patches.

Proactive Monitoring: Monitor database query logs for unusual syntax or patterns that deviate from standard application behavior, particularly those originating from the prescription module.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection payloads.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository provided in the references.

The severity of this SQL injection vulnerability necessitates an immediate response, especially given the sensitive nature of the data stored within OpenEMR. Administrators must prioritize updating to version 8.0.0 to remediate the flaw at the source. Failure to patch allows authenticated users to potentially gain full control over the backend database, making this a critical security priority.