The NVD description says a critical SQL injection flaw in OpenEMR before 8.3.0 could let an authenticated low-privileged user with Fee Sheet access extract patient data and bcrypt password hashes. The attack works through a time-based blind technique against the Fee Sheet drug-inventory lookup.
What Is It
CVE-2026-124469 is an SQL injection vulnerability (CWE-89) in OpenEMR's Fee Sheet drug-inventory lookup, in the DrugSalesService::sellDrug function. The function puts the prod[N][warehouse] POST field directly into an ORDER BY clause.
According to the NVD description, an authenticated user with low privileges can submit Fee Sheet product lines that contain constant subqueries. This lets them run a time-based blind oracle against the database. Data would be inferred bit by bit from response timing rather than returned directly. VulnCheck disclosed the issue, and the NVD record was published on 2026-11-08. NVD lists its status as "Received."
Why It Matters
VulnCheck scores this flaw 9.9 (Critical) under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and 9.4 (Critical) under CVSS 4.0. Several factors raise the risk:
- Attackable over the network with low attack complexity and no user interaction.
- Only low privileges are needed. Any authenticated account that can reach the Fee Sheet is a possible starting point.
- High-value data is exposed. The described impact includes extracting patient data and the bcrypt password hashes stored in
users_secure. In an electronic medical records system, that means both protected health information and credentials that could be cracked offline. - Scope is Changed under CVSS 3.1, with high confidentiality, integrity and availability impact.
The supplied CISA KEV data contains no entry for this CVE. Active exploitation is not confirmed by KEV as of this writing.
What's Vulnerable
- Vendor: OpenEMR
- Product: OpenEMR
- Affected: all versions before 8.3.0
- Unaffected: 8.3.0
No CPE configurations were included in the NVD record at publication.
Patch Status
Version 8.3.0 is listed as unaffected. Administrators running any OpenEMR version earlier than 8.3.0 should upgrade to 8.3.0 or later. The GitHub security advisory (GHSA-cg8c-2v5q-29g7) has the vendor's guidance.
The flaw needs authentication, so organizations should also check which accounts can reach Fee Sheet functionality until the upgrade is done. Because users_secure hashes are within reach of the injection, consider rotating credentials if compromise is suspected.
There is no CISA KEV entry, so no federal remediation deadline applies at this time.