CVE-2026-49142

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.5.0

Description An authenticated SQL injection exists in the Syndromic Surveillance module. Users with Clinician-level privileges can read and modify arbitrary database contents by submitting crafted values to the form icd codes[] POST parameter at the 'syndromicsurveillance/index' endpoint. The issue allows the use of an unquoted numeric IN() clause and UNION DISTINCT SELECT statement with hex-encoded literals to abuse the MySQL extractvalue() function for error-based exfiltration of bcrypt password hashes. Additionally, stacked queries can be executed to reset passwords, leading to full administrative account takeover.

Recommendations Update to version 8.5.0. Restrict access to the 'syndromicsurveillance/index' endpoint or avoid using the form icd codes[] parameter until the update is applied.