CVE-2026-124469

CVSS 9.9 (critical) · published 2026-11-08

OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDrug) that interpolates the prod[N][warehouse] POST field into an ORDER BY clause. Low-privileged authenticated users can submit Fee Sheet product lines with constant subqueries to run a time-based blind oracle, extracting patient data and users_secure bcrypt hashes.

Weakness: CWE-89

Source: NVD CVE-2026-124469

References

• https://github.com/openemr/openemr/security/advisories/GHSA-cg8c-2v5q-29g7
• https://www.vulncheck.com/advisories/openemr-before-8.3.0-sql-injection-via-fee-sheet-warehouse-parameter

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.