OpenEMR versions prior to 8.3.0 suffer from an SQL injection flaw in the Standard REST API endpoints that handle patient insurance and employer searches. The vulnerability arises because the code concatenates query‑string parameter names directly into the SQL query as column identifiers without proper escaping, allowing an attacker to inject arbitrary SQL statements. As a result, an attacker can extract personal health information, user account data, and even API client secrets tied to the platform.

This issue affects the OpenEMR software suite, specifically any deployment using OpenEMR before version 8.3.0. The affected component is the patient insurance and employer search endpoint of the REST API. Users of older OpenEMR installations, especially those that expose these endpoints to authenticated clients, are at risk.

The CVSS base score is 7.1, indicating serious confidentiality and integrity threats. The EPSS score is not available, so the current exploit probability is unspecified, but the flaw is publicly documented and exploit code could be trivial for an authenticated user. Attackers need authenticated access, including low‑privilege patient‑portal OAuth2 tokens, to send crafted parameter names to /api/patient/{puuid}/insurance or /api/patient/{puuid}/employer. The vulnerability is not listed in CISA's KEV catalog, suggesting no known large‑scale exploitation yet, but the high impact warrants prompt remediation.