Loading vulnerability…
Blind SQL Injection in OpenEMR Patient Search
CVE-2026-29187 is a blind SQL injection vulnerability in OpenEMR affecting versions prior to 8.0.0.3. The flaw is present in the Patient Search functionality at /interface/new/new_search_popup.php. An authenticated attacker can exploit the issue by manipulating HTTP parameter keys, rather than parameter values, to inject arbitrary SQL into backend database queries. Because the issue is blind SQL injection, successful exploitation may not directly return query results in the HTTP response, but still permits inference-based or side-channel extraction and unauthorized database interaction. The vulnerability is classified as CWE-89.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated attacker to execute arbitrary SQL commands against the OpenEMR backend database. This can result in unauthorized access to sensitive data, including medical and patient-related records, and unauthorized modification of stored data. Based on the provided CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the primary impacts are high confidentiality loss and high integrity compromise, with no stated direct availability impact.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict access to OpenEMR to only trusted authenticated users, minimize the number of accounts with access to the Patient Search functionality, and closely monitor application and database logs for anomalous requests targeting /interface/new/new_search_popup.php, especially requests with unexpected or malformed HTTP parameter names. Applying compensating controls such as WAF rules or reverse-proxy filtering that reject abnormal parameter-key patterns may reduce exposure, but upgrading to 8.0.0.3 or later is the definitive mitigation.
Patch, then assume compromise.
Upgrade OpenEMR to version 8.0.0.3 or later, which contains the vendor patch for this vulnerability. The provided references indicate the fix is included in release v8_0_0_3 and associated with commit c61887aa7c83e83b3282db05246f1c00de3aa21d.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.