Description
OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows authenticated users to inject SQL through request parameter names used as column names. Attackers can send crafted patient_data-*-sel parameters to the revandapprove route, lacking ACL and CSRF checks, to copy password hashes into patient fields or corrupt records.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openemr | openemr | < 8.5.0 | 8.5.0 |
References
- GitHub Security Advisory (GHSA-86hf-j825-r56h) vendor-advisory
- VulnCheck Advisory: OpenEMR before 8.5.0 SQL Injection via CCR revandapprove Parameter Names third-party-advisory