CVE-2026-49142— OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]

Quick assessment

Affected

openemr openemr

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 OpenEMR 8.5.0 之前的版本中，"Syndromic Surveillance"（综合征监测）模块存在一个认证 SQL 注入漏洞。拥有 Clinician（临床医生）级别权限的用户，可以通过向端点提交经过篡改的 POST 参数，读取和修改任意数据库内容。攻击者可利用该漏洞注入未加引号的数值型子句以及语句，并使用十六进制编码的字面量滥用 MySQL 的函数，从而通过错误注入方式窃取 bcrypt 加密的密码哈希值；此外，攻击者还能执行堆叠查询以重置密码，最终实现对管理员账户的完全接管。

CVSS 8.8 · High Updated Oct 29, 2026

Possible ATT&CK Techniques 3 AI

T1003 · OS Credential Dumping T1059.007 · JavaScript T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]

Source: CVE Program / CVE List V5

Vulnerability Description

OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values in the form_icd_codes[] POST parameter to the syndromicsurveillance/index endpoint. Attackers can inject an unquoted numeric IN() clause and UNION DISTINCT SELECT statement using hex-encoded literals to abuse MySQL extractvalue() for error-based exfiltration of bcrypt password hashes and execute stacked queries that reset passwords, resulting in full administrative account takeover.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
openemr	openemr	0 ~ 8.5.0	-

II. Public POCs for CVE-2026-49142

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-49142

请登录查看更多情报信息。

Other References for CVE-2026-49142 (5)

https://github.com/openemr/openemr/commit/9b52cc0fc3a4eddd9fa7a096f6a3ac2a57d772d0 patch issue-tracking
https://github.com/openemr/openemr/pull/14329 issue-tracking patch
https://github.com/openemr/openemr/releases/tag/v8_5_0 release-notes
https://github.com/openemr/openemr/security/advisories/GHSA-w99c-jwcm-24hh vendor-advisory
https://www.vulncheck.com/advisories/openemr-before-sql-injection-via-form-icd-codes third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-49142

IV. Related Vulnerabilities

Same product: openemr

Same vendor: openemr

Same weakness: CWE-89