A high-severity SQL injection vulnerability in OpenEMR allows authenticated attackers to compromise sensitive medical records and practice management data.

The vulnerability is a SQL injection (CWE-89) located in the ajax_save page within the CAMOS form. It requires an authenticated user to trigger the flaw, which occurs due to improper neutralization of special elements used in SQL commands.

The exploitation of this vulnerability poses a severe risk to healthcare data integrity and confidentiality. Because OpenEMR manages electronic health records, unauthorized SQL execution could lead to the theft of patient data, modification of medical histories, or complete system compromise. With a CVSS score of 8.8, this flaw represents a significant threat to organizational compliance and patient safety.

Immediate Action: Update OpenEMR to version 8.0.0.3 or later immediately to apply the patch for the vulnerable ajax_save function.

Proactive Monitoring: Review application access logs for unusual SQL patterns or unexpected POST requests directed at the ajax_save endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting medical management software.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Given the sensitivity of the data managed by OpenEMR, the risk of SQL injection cannot be overstated. Administrators should prioritize the upgrade to version 8.0.0.3 across all production environments to neutralize this threat. Until updates are applied, restrict access to the affected CAMOS form to authorized personnel only to limit the potential attack surface.