CVE-2026-124469

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0

Description An SQL injection issue exists in the Fee Sheet drug-inventory lookup within the sellDrug() function of the DrugSalesService class. The flaw occurs when the prod[N][warehouse] POST field is interpolated into an ORDER BY clause. Low-privileged authenticated users can exploit this by submitting Fee Sheet product lines containing constant subqueries to perform a time-based blind oracle attack, allowing the extraction of patient data and users secure bcrypt hashes.

Recommendations Update to version 8.3.0 or later.