{"id":"CVE-2026-49142","kind":"vulnerability","aliases":["CVE-2026-49142"],"related":[],"title":"OpenEMR: clinician SQL injection enables full admin account takeover","description":"OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values in the form_icd_codes[] POST parameter to the syndromicsurveillance/index endpoint. Attackers can inject an unquoted numeric IN() clause and UNION DISTINCT SELECT statement using hex-encoded literals to abuse MySQL extractvalue() for error-based exfiltration of bcrypt password hashes and execute stacked queries that reset passwords, resulting in full administrative account takeover.","summary":"OpenEMR before 8.5.0 has a SQL injection flaw in its Syndromic Surveillance module, reachable through the form_icd_codes[] POST parameter. A user with Clinician-level access can read and change any database content, including bcrypt password hashes, and reset passwords to take over administrator accounts.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["healthcare","mysql","openemr","runtime","self-hosted"],"not_affected_if":["no-clinician-accounts","openemr-8.5.0-or-later"],"how_to_check":"- Check the installed OpenEMR version in the application's version file or admin footer; it is affected if below `8.5.0`.\n- Confirm whether the Syndromic Surveillance module is in use by reviewing the module list in OpenEMR's administration settings.","fix":"- Move to OpenEMR `8.5.0` or later.","status":"open","published_at":"2026-10-29T13:17:12+00:00","first_seen_at":"2026-10-29T13:25:08+00:00","triaged_at":"2026-10-29T13:25:34+00:00","updated_at":"2026-10-29T13:25:34+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-29T13:25:34Z","model":"claude-haiku-5-5","output":{"fix":"- Move to OpenEMR `8.5.0` or later.","reach":"network","title":"OpenEMR: clinician SQL injection enables full admin account takeover","impact":"high","summary":"OpenEMR before 8.5.0 has a SQL injection flaw in its Syndromic Surveillance module, reachable through the form_icd_codes[] POST parameter. A user with Clinician-level access can read and change any database content, including bcrypt password hashes, and reset passwords to take over administrator accounts.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["openemr","self-hosted","healthcare","mysql"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"attacker takes over administrator accounts and reads or changes all data","analyst_note":"Confirm whether Syndromic Surveillance is enabled by default and check the NVD entry for the exact affected version range.","how_to_check":"- Check the installed OpenEMR version in the application's version file or admin footer; it is affected if below `8.5.0`.\n- Confirm whether the Syndromic Surveillance module is in use by reviewing the module list in OpenEMR's administration settings.","plain_action":"","needs_analyst":true,"not_affected_if":["openemr-8.5.0-or-later","no-clinician-accounts"],"who_is_affected":"OpenEMR installations before 8.5.0 that have the Syndromic Surveillance module reachable by users with Clinician-level privileges. Clinician-role users are the attack path, so deployments that restrict or lack such accounts face lower risk. Sources do not state whether the module is enabled by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000731,"input_tokens":4252,"output_tokens":611,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-49142':12A,15A '8.5.0':25B,72C 'abus':133C 'access':50B 'account':8A,69B,156C 'admin':7A 'administr':68B,155C 'allow':85C 'arbitrari':96C 'attack':114C 'authent':75C 'base':139C 'bcrypt':59B,142C 'chang':54B 'claus':121C 'clinician':2A,48B,89C 'clinician-level':47B,88C 'code':41B,107C 'contain':73C 'content':57B,98C 'craft':101C 'cve':10A,13A 'databas':56B,97C 'distinct':124C 'enabl':5A 'encod':130C 'endpoint':113C 'error':138C 'error-bas':137C 'execut':146C 'exfiltr':140C 'extractvalu':135C 'flaw':30B 'form':39B,105C 'full':6A,154C 'hash':61B,144C 'healthcar':16B 'hex':129C 'hex-encod':128C 'host':22B 'icd':40B,106C 'includ':58B 'inject':4A,29B,77C,116C 'level':49B,90C 'liter':131C 'modifi':95C 'modul':35B,83C 'mysql':17B,134C 'numer':119C 'openemr':1A,18B,23B,70C 'paramet':43B,109C 'password':60B,64B,143C,151C 'post':42B,108C 'privileg':91C 'queri':148C 'reachabl':36B 'read':52B,93C 'reset':63B,150C 'result':152C 'runtim':19B 'select':125C 'self':21B 'self-host':20B 'sql':3A,28B,76C 'stack':147C 'statement':126C 'submit':100C 'surveil':34B,82C 'syndrom':33B,81C 'syndromicsurveillance/index':112C 'take':66B 'takeov':9A,157C 'union':123C 'unquot':118C 'use':127C 'user':45B,86C 'valu':102C 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"OpenEMR installations before 8.5.0 that have the Syndromic Surveillance module reachable by users with Clinician-level privileges. Clinician-role users are the attack path, so deployments that restrict or lack such accounts face lower risk. Sources do not state whether the module is enabled by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T13:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-49142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49142","severity":null,"published_at":"2026-10-29T13:17:12+00:00","modified_at":"2026-10-29T13:17:12+00:00","first_seen_at":"2026-10-29T13:25:08+00:00","fetched_at":"2026-10-29T13:25:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}