A high-severity SQL injection vulnerability in OpenEMR allows authenticated attackers to potentially compromise the entire electronic health records database.

The software suffers from a SQL injection flaw (CWE-89) within the ajax graphs library due to insufficient input validation. This vulnerability requires the attacker to have an authenticated session to trigger the malicious SQL commands.

The ability to perform SQL injection poses a significant risk to the confidentiality, integrity, and availability of sensitive patient medical records. Given the CVSS score of 8.8, this vulnerability could lead to full unauthorized database access, potential data exfiltration of protected health information, and severe regulatory and reputational consequences for medical facilities.

Immediate Action: Upgrade all instances of OpenEMR to version 8.0.0.1 or later to incorporate the vendor-supplied fix.

Proactive Monitoring: Review application access logs for suspicious database queries or unusual URL parameters associated with the ajax graphs library.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection patterns targeting the application.

Public Exploit Available: Yes — a public proof-of-concept repository exists on GitHub.

The severity of this flaw and the availability of a public proof-of-concept mandate an immediate response. Security teams should prioritize the update to version 8.0.0.1 across all production environments to eliminate the injection vector and secure sensitive patient data.