Live › vulnerability › CVE-2026-49142
OpenEMR before 8.5.0 has a SQL injection flaw in its Syndromic Surveillance module, reachable through the form_icd_codes[] POST parameter. A user with Clinician-level access can read and change any database content, including bcrypt password hashes, and reset passwords to take over administrator accounts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 13:25 UTC. All times on this page are UTC.
OpenEMR installations before 8.5.0 that have the Syndromic Surveillance module reachable by users with Clinician-level privileges. Clinician-role users are the attack path, so deployments that restrict or lack such accounts face lower risk. Sources do not state whether the module is enabled by default.
No product ranges from the sources yet.
8.5.0.8.5.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values in the form_icd_codes[] POST parameter to the syndromicsurveillance/index endpoint. Attackers can inject an unquoted numeric IN() clause and UNION DISTINCT SELECT statement using hex-encoded literals to abuse MySQL extractvalue() for error-based exfiltration of bcrypt password hashes and execute stacked queries that reset passwords, resulting in full administrative account takeover.
This page as .md · .json · in your agent: get_signal("CVE-2026-49142")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.