Description
OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal api/onsiteactivityviews endpoint that allows any authenticated staff user to inject SQL through unquoted Id_BitwiseAnd Criteria values. Attackers can close the bitwise parenthesis and append OR or UNION SELECT clauses to read patient PHI, staff password hashes, MySQL authentication strings, and API tokens.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openemr | openemr | < 8.5.0 | 8.5.0 |
References
- GitHub Security Advisory (GHSA-vvj8-xpx8-p293) vendor-advisory
- VulnCheck Advisory: OpenEMR before 8.5.0 SQL Injection via OnsiteActivityView _BitwiseAnd Criteria third-party-advisory