CVE-2026-33909: OpenEMR SQL Injection Vulnerability

CVE-2026-33909 Overview

CVE-2026-33909 is a SQL Injection vulnerability affecting OpenEMR, a widely-used free and open source electronic health records (EHR) and medical practice management application. Prior to version 8.0.0.3, several variables in the MedEx recall/reminder processing code are concatenated directly into SQL queries without parameterization or type casting, enabling SQL injection attacks. This vulnerability poses significant risks to healthcare organizations relying on OpenEMR for patient data management.

Critical Impact
Authenticated attackers with high privileges can exploit this SQL injection vulnerability to extract or manipulate sensitive electronic health records and patient data stored in OpenEMR databases.

Affected Products

OpenEMR versions prior to 8.0.0.3
open-emr openemr (all versions before the security patch)
MedEx recall/reminder processing module

Discovery Timeline

2026-03-25 - CVE-2026-33909 published to NVD
2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33909

Vulnerability Analysis

This SQL Injection vulnerability exists in the MedEx recall/reminder processing functionality of OpenEMR. The root cause stems from improper handling of user-supplied input where several variables are directly concatenated into SQL queries without proper parameterization, escaping, or type casting. An authenticated attacker with high privileges can craft malicious input to manipulate database queries, potentially gaining unauthorized access to sensitive patient health records or modifying critical healthcare data.

The attack requires network access and high-level privileges within the OpenEMR application. While the attack complexity is high, successful exploitation could result in significant confidentiality and integrity impacts to the electronic health records system.

Root Cause

The vulnerability originates from insecure coding practices in the MedEx module where user input from $_REQUEST arrays (such as facilities and providers parameters) is directly incorporated into SQL statements. The vulnerable code in interface/main/messages/save.php uses implode() on raw request data without validating that the input contains only expected integer values. Similarly, in library/MedEx/API.php, appointment status values are concatenated into SQL IN clauses without proper escaping or parameterized query construction.

Attack Vector

The attack vector is network-based, requiring an authenticated user with high privileges to submit specially crafted input through the MedEx recall/reminder interface. The attacker can inject malicious SQL through the facilities, providers, or appointment status parameters. Since these values are concatenated directly into SQL queries, an attacker can break out of the intended query structure and execute arbitrary SQL commands, potentially extracting sensitive patient data or manipulating database records.

php

// Vulnerable code pattern in interface/main/messages/save.php
// Before patch - raw request data concatenated into queries
$facilities = implode("|", $_REQUEST['facilities']);
$providers = implode("|", $_REQUEST['providers']);

// After patch - input validation with FILTER_VALIDATE_INT
$facilities = implode("|", filter_input(INPUT_POST, 'facilities', FILTER_VALIDATE_INT, FILTER_REQUIRE_ARRAY) ?: []);
$providers = implode("|", filter_input(INPUT_POST, 'providers', FILTER_VALIDATE_INT, FILTER_REQUIRE_ARRAY) ?: []);

Source: GitHub Commit 3d11d2f

php

// Vulnerable code pattern in library/MedEx/API.php
// Before patch - direct concatenation into SQL IN clause
$list = implode('|', $event['T_appt_stats']);
$appt_status = " and pc_appstatus in (" . $list . ")";

// After patch - parameterized placeholders with escaped values
$statPlaceholders = implode(',', array_fill(0, count($event['T_appt_stats']), '?'));
$appt_status = " and pc_appstatus in (" . $statPlaceholders . ")";
foreach ($event['T_appt_stats'] as $stat) {
    $escapedArr[] = $stat;
}

Source: GitHub Commit 3d11d2f

Detection Methods for CVE-2026-33909

Indicators of Compromise

Unusual SQL query patterns in OpenEMR database logs containing unexpected characters or SQL keywords in facility/provider parameters
Anomalous access patterns to the MedEx recall/reminder functionality from privileged accounts
Database error logs showing SQL syntax errors related to the pc_appstatus, facilities, or providers fields
Unexpected data modifications or bulk data extraction from patient records tables

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in POST requests to /interface/main/messages/save.php
Monitor application logs for SQL injection signatures including UNION SELECT, OR 1=1, and comment sequences (--) in request parameters
Enable database query logging and alert on queries with suspicious patterns in the MedEx-related tables
Deploy intrusion detection systems with signatures for common SQL injection attack patterns targeting healthcare applications

Monitoring Recommendations

Configure real-time alerting for failed SQL queries or database errors originating from the MedEx module
Implement user behavior analytics to detect privileged accounts accessing unusual amounts of patient data
Monitor for authentication anomalies followed by access to the recall/reminder processing endpoints
Review access logs for the library/MedEx/API.php and interface/main/messages/save.php files regularly

How to Mitigate CVE-2026-33909

Immediate Actions Required

Upgrade OpenEMR to version 8.0.0.3 or later immediately to apply the security patch
Audit database access logs for any signs of exploitation prior to patching
Review privileged user accounts with access to MedEx functionality for unauthorized activity
Implement network segmentation to limit access to OpenEMR administrative interfaces

Patch Information

OpenEMR has released version 8.0.0.3 which contains the security patch for this vulnerability. The fix implements proper input validation using filter_input() with FILTER_VALIDATE_INT for the facilities and providers parameters, and converts dynamic SQL concatenation to parameterized queries with placeholders for appointment status values.

For detailed patch information, refer to:

Workarounds

Restrict network access to OpenEMR MedEx recall/reminder functionality to trusted IP addresses only
Implement additional WAF rules to filter SQL injection patterns in request parameters targeting the affected endpoints
Temporarily disable the MedEx recall/reminder module if not critical to operations until patching is complete
Enforce strict role-based access controls to limit the number of users with high privileges required to exploit this vulnerability

bash

# Example: Restrict access to affected endpoints via Apache configuration
<Location "/interface/main/messages/save.php">
    Require ip 10.0.0.0/8 192.168.0.0/16
    # Or implement additional ModSecurity rules
</Location>

# Enable detailed logging for affected files
CustomLog /var/log/openemr/medex_access.log combined