OpenEMR versions prior to 8.0.0.3 are vulnerable to a blind SQL injection attack that allows authenticated users to compromise sensitive medical database information.

This is a blind SQL injection vulnerability (CWE-89) located in the patient search module (interface/new/new_search_popup.php). An authenticated attacker can manipulate HTTP parameter keys to execute unauthorized SQL queries against the backend database.

The exploitation of this vulnerability poses a significant risk to the confidentiality and integrity of electronic health records. Given the CVSS score of 8.1, this is a high severity issue that could lead to unauthorized data exfiltration, modification of patient records, or potential disruption of medical practice management services.

Immediate Action: Upgrade OpenEMR to version 8.0.0.3 or later to apply the necessary security patches.

Proactive Monitoring: Review database access logs for unusual query patterns or unexpected SQL syntax errors originating from the patient search interface.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns in HTTP request parameters.

Public Exploit Available: Yes — a public proof-of-concept exists via a GitHub repository.

The presence of a public proof-of-concept combined with the sensitive nature of the data managed by OpenEMR necessitates immediate attention. Administrators must prioritize updating to version 8.0.0.3 to eliminate the SQL injection vector. Failure to patch leaves the system open to unauthorized database manipulation by any authenticated user on the network.