{"id":"CVE-2026-126489","kind":"vulnerability","aliases":["CVE-2026-126489"],"related":[],"title":"OpenEMR: second-order SQL injection in IPPF contraceptive issue feature","description":"OpenEMR before 8.5.0 contains a second-order SQL injection vulnerability in the IPPF contraceptive issue feature because issue_ippf_con_save concatenates layout_options field_id values into a REPLACE INTO query as column names. Authenticated administrators can add a malicious field_id via edit_layout.php, then trigger issue_ippf_con_save through add_edit_issue.php to execute arbitrary SQL.","summary":"OpenEMR before 8.5.0 builds a REPLACE INTO query by concatenating layout field_id values as column names, so a crafted field_id is executed as SQL. An authenticated administrator can run arbitrary SQL against the clinic database.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","openemr","package","php","self-hosted"],"not_affected_if":["no-admin-exposure","version-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version in the admin footer or `version.php` and compare it with the fixed version.\n- Review who holds administrator rights and whether layout editing (edit_layout.php) is limited to trusted staff.","fix":"- OpenEMR: upgrade to `8.5.0` or later.","status":"open","published_at":"2026-11-13T10:17:59+00:00","first_seen_at":"2026-11-13T10:47:26+00:00","triaged_at":"2026-11-13T10:50:43+00:00","updated_at":"2026-11-13T10:50:43+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:50:43Z","model":"claude-haiku-5-5","output":{"fix":"- OpenEMR: upgrade to `8.5.0` or later.","reach":"network","title":"OpenEMR: second-order SQL injection in IPPF contraceptive issue feature","impact":"high","summary":"OpenEMR before 8.5.0 builds a REPLACE INTO query by concatenating layout field_id values as column names, so a crafted field_id is executed as SQL. An authenticated administrator can run arbitrary SQL against the clinic database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openemr","healthcare","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"database contents read, modified or deleted by SQL execution","analyst_note":"","how_to_check":"- Check the installed OpenEMR version in the admin footer or `version.php` and compare it with the fixed version.\n- Review who holds administrator rights and whether layout editing (edit_layout.php) is limited to trusted staff.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-8.5.0-or-later","no-admin-exposure"],"who_is_affected":"OpenEMR installations before 8.5.0 that use the IPPF contraceptive issue feature. The attacker must hold an administrator account that can edit layouts, so limit admin accounts and patch to 8.5.0. Sites on a fixed version are not exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00073,"input_tokens":4645,"output_tokens":531,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126489':14A,17A '-2026':13A,16A '8.5.0':27B,64C 'add':101C 'add_edit_issue.php':115C 'administr':53B,99C 'arbitrari':56B,118C 'authent':52B,98C 'build':28B 'clinic':60B 'column':40B,96C 'con':82C,112C 'concaten':34B,84C 'contain':65C 'contracept':9A,76C 'craft':44B 'cve':12A,15A 'databas':61B 'edit_layout.php':107C 'execut':48B,117C 'featur':11A,78C 'field':36B,45B,87C,104C 'healthcar':18B 'host':24B 'id':37B,46B,88C,105C 'inject':6A,71C 'ippf':8A,75C,81C,111C 'issu':10A,77C,80C,110C 'layout':35B,85C 'malici':103C 'name':41B,97C 'openemr':1A,19B,25B,62C 'option':86C 'order':4A,69C 'packag':20B 'php':21B 'queri':32B,94C 'replac':30B,92C 'run':55B 'save':83C,113C 'second':3A,68C 'second-ord':2A,67C 'self':23B 'self-host':22B 'sql':5A,50B,57B,70C,119C 'trigger':109C 'valu':38B,89C 'via':106C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"OpenEMR installations before 8.5.0 that use the IPPF contraceptive issue feature. The attacker must hold an administrator account that can edit layouts, so limit admin accounts and patch to 8.5.0. Sites on a fixed version are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["healthcare","high","openemr","package","php","selfhosted"],"campaign_type":null,"search_a":"'-126489':14A,17A '-2026':13A,16A 'contracept':9A 'cve':12A,15A 'featur':11A 'inject':6A 'ippf':8A 'issu':10A 'openemr':1A 'order':4A 'second':3A 'second-ord':2A 'sql':5A","search_b":"'8.5.0':27B 'administr':53B 'arbitrari':56B 'authent':52B 'build':28B 'clinic':60B 'column':40B 'concaten':34B 'craft':44B 'databas':61B 'execut':48B 'field':36B,45B 'healthcar':18B 'host':24B 'id':37B,46B 'layout':35B 'name':41B 'openemr':19B,25B 'packag':20B 'php':21B 'queri':32B 'replac':30B 'run':55B 'self':23B 'self-host':22B 'sql':50B,57B 'valu':38B","search_c":"'8.5.0':64C 'add':101C 'add_edit_issue.php':115C 'administr':99C 'arbitrari':118C 'authent':98C 'column':96C 'con':82C,112C 'concaten':84C 'contain':65C 'contracept':76C 'edit_layout.php':107C 'execut':117C 'featur':78C 'field':87C,104C 'id':88C,105C 'inject':71C 'ippf':75C,81C,111C 'issu':77C,80C,110C 'layout':85C 'malici':103C 'name':97C 'openemr':62C 'option':86C 'order':69C 'queri':94C 'replac':92C 'save':83C,113C 'second':68C 'second-ord':67C 'sql':70C,119C 'trigger':109C 'valu':89C 'via':106C 'vulner':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T01:44:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126489","severity":null,"published_at":"2026-11-13T10:17:59+00:00","modified_at":"2026-11-13T10:17:59+00:00","first_seen_at":"2026-11-13T10:47:26+00:00","fetched_at":"2026-11-13T10:47:26+00:00","note":null}],"documents":[{"id":145221,"url":"https://github.com/openemr/openemr/security/advisories/GHSA-8j6v-q545-q9q7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T01:44:54+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145222,"url":"https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-ippf-contraceptive-issue-feature","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}