CVE-2026-33909: OpenEMR SQL Injection Vulnerability

CVE-2026-33909 Overview

CVE-2026-33909 is a SQL Injection vulnerability affecting OpenEMR, a widely-used free and open source electronic health records (EHR) and medical practice management application. Prior to version 8.0.0.3, several variables in the MedEx recall/reminder processing code are concatenated directly into SQL queries without parameterization or type casting, enabling SQL injection attacks. This vulnerability poses significant risks to healthcare organizations relying on OpenEMR for patient data management.

Critical Impact

Authenticated attackers with high privileges can exploit this SQL injection vulnerability to extract or manipulate sensitive electronic health records and patient data stored in OpenEMR databases.

Affected Products

• OpenEMR versions prior to 8.0.0.3
• open-emr openemr (all versions before the security patch)
• MedEx recall/reminder processing module

Discovery Timeline

• 2026-03-25 - CVE-2026-33909 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33909

Vulnerability Analysis

This SQL Injection vulnerability exists in the MedEx recall/reminder processing functionality of OpenEMR. The root cause stems from improper handling of user-supplied input where several variables are directly concatenated into SQL queries without proper parameterization, escaping, or type casting. An authenticated attacker with high privileges can craft malicious input to manipulate database queries, potentially gaining unauthorized access to sensitive patient health records or modifying critical healthcare data.

The attack requires network access and high-level privileges within the OpenEMR application. While the attack complexity is high, successful exploitation could result in significant confidentiality and integrity impacts to the electronic health records system.

Root Cause

The vulnerability originates from insecure coding practices in the MedEx module where user input from $_REQUEST arrays (such as facilities and providers parameters) is directly incorporated into SQL statements. The vulnerable code in interface/main/messages/save.php uses implode() on raw request data without validating that the input contains only expected integer values. Similarly, in library/MedEx/API.php, appointment status values are concatenated into SQL IN clauses without proper escaping or parameterized query construction.

Attack Vector

The attack vector is network-based, requiring an authenticated user with high privileges to submit specially crafted input through the MedEx recall/reminder interface. The attacker can inject malicious SQL through the facilities, providers, or appointment status parameters. Since these values are concatenated directly into SQL queries, an attacker can break out of the intended query structure and execute arbitrary SQL commands, potentially extracting sensitive patient data or manipulating database records.

// Vulnerable code pattern in interface/main/messages/save.php
// Before patch - raw request data concatenated into queries
$facilities = implode("|", $_REQUEST['facilities']);
$providers = implode("|", $_REQUEST['providers']);

// After patch - input validation with FILTER_VALIDATE_INT
$facilities = implode("|", filter_input(INPUT_POST, 'facilities', FILTER_VALIDATE_INT, FILTER_REQUIRE_ARRAY) ?: []);
$providers = implode("|", filter_input(INPUT_POST, 'providers', FILTER_VALIDATE_INT, FILTER_REQUIRE_ARRAY) ?: []);

Source: GitHub Commit 3d11d2f

// Vulnerable code pattern in library/MedEx/API.php
// Before patch - direct concatenation into SQL IN clause
$list = implode('|', $event['T_appt_stats']);
$appt_status = " and pc_appstatus in (" . $list . ")";

// After patch - parameterized placeholders with escaped values
$statPlaceholders = implode(',', array_fill(0, count($event['T_appt_stats']), '?'));
$appt_status = " and pc_appstatus in (" . $statPlaceholders . ")";
foreach ($event['T_appt_stats'] as $stat) {
    $escapedArr[] = $stat;
}

Source: GitHub Commit 3d11d2f

Detection Methods for CVE-2026-33909

Indicators of Compromise

• Unusual SQL query patterns in OpenEMR database logs containing unexpected characters or SQL keywords in facility/provider parameters
• Anomalous access patterns to the MedEx recall/reminder functionality from privileged accounts
• Database error logs showing SQL syntax errors related to the pc_appstatus, facilities, or providers fields
• Unexpected data modifications or bulk data extraction from patient records tables

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in POST requests to /interface/main/messages/save.php
• Monitor application logs for SQL injection signatures including UNION SELECT, OR 1=1, and comment sequences (--) in request parameters
• Enable database query logging and alert on queries with suspicious patterns in the MedEx-related tables
• Deploy intrusion detection systems with signatures for common SQL injection attack patterns targeting healthcare applications

Monitoring Recommendations

• Configure real-time alerting for failed SQL queries or database errors originating from the MedEx module
• Implement user behavior analytics to detect privileged accounts accessing unusual amounts of patient data
• Monitor for authentication anomalies followed by access to the recall/reminder processing endpoints
• Review access logs for the library/MedEx/API.php and interface/main/messages/save.php files regularly

How to Mitigate CVE-2026-33909

Immediate Actions Required

• Upgrade OpenEMR to version 8.0.0.3 or later immediately to apply the security patch
• Audit database access logs for any signs of exploitation prior to patching
• Review privileged user accounts with access to MedEx functionality for unauthorized activity
• Implement network segmentation to limit access to OpenEMR administrative interfaces

Patch Information

OpenEMR has released version 8.0.0.3 which contains the security patch for this vulnerability. The fix implements proper input validation using filter_input() with FILTER_VALIDATE_INT for the facilities and providers parameters, and converts dynamic SQL concatenation to parameterized queries with placeholders for appointment status values.

For detailed patch information, refer to:

• GitHub Security Advisory GHSA-6vx2-w9hw-prqj
• GitHub Release v8.0.0.3
• Security Patch Commit

Workarounds

• Restrict network access to OpenEMR MedEx recall/reminder functionality to trusted IP addresses only
• Implement additional WAF rules to filter SQL injection patterns in request parameters targeting the affected endpoints
• Temporarily disable the MedEx recall/reminder module if not critical to operations until patching is complete
• Enforce strict role-based access controls to limit the number of users with high privileges required to exploit this vulnerability

# Example: Restrict access to affected endpoints via Apache configuration
<Location "/interface/main/messages/save.php">
    Require ip 10.0.0.0/8 192.168.0.0/16
    # Or implement additional ModSecurity rules
</Location>

# Enable detailed logging for affected files
CustomLog /var/log/openemr/medex_access.log combined