Description
OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where mass-assigned _BitwiseAnd criteria parameters are placed unquoted into SQL with only quote-character escaping. Authenticated portal patients can inject SQL outside their per-patient scope to read the entire database, including other patients' demographics and users_secure password hashes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openemr | openemr | < 8.5.0 | 8.5.0 |
References
- GitHub Security Advisory (GHSA-g2xw-rvhq-x543) vendor-advisory
- VulnCheck Advisory: OpenEMR before 8.5.0 SQL Injection via OnsiteDocument.Query _BitwiseAnd third-party-advisory