{"id":"CVE-2026-49142","title":"OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]","summary":"OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-89"],"vendor":"openemr","product":"openemr","affected":["openemr < 8.5.0"],"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T12:37:16.791Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-49142","references":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-w99c-jwcm-24hh","label":"GitHub Security Advisory (GHSA-w99c-jwcm-24hh)"},{"url":"https://github.com/openemr/openemr/releases/tag/v8_5_0","label":"Release Notes"},{"url":"https://github.com/openemr/openemr/pull/14329","label":"Pull Request"},{"url":"https://github.com/openemr/openemr/commit/9b52cc0fc3a4eddd9fa7a096f6a3ac2a57d772d0","label":"Patch Commit"},{"url":"https://www.vulncheck.com/advisories/openemr-before-sql-injection-via-form-icd-codes","label":"VulnCheck Advisory: OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]"}],"tags":["cve.org"],"epss":0.00355,"epssPercentile":0.29245,"ingestedAt":"2026-11-01T18:59:04.472Z","slug":"CVE-2026-49142","body":"## Overview\n\nOpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values in the form_icd_codes[] POST parameter to the syndromicsurveillance/index endpoint. Attackers can inject an unquoted numeric IN() clause and UNION DISTINCT SELECT statement using hex-encoded literals to abuse MySQL extractvalue() for error-based exfiltration of bcrypt password hashes and execute stacked queries that reset passwords, resulting in full administrative account takeover.\n\n## Affected\n\n- `openemr < 8.5.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}