The vulnerability is an unsanitized string interpolation in the Fee Sheet drug‑inventory lookup of OpenEMR that allows low‑privileged authenticated users to inject arbitrary SQL via the prod[N][warehouse] POST field. By crafting a value that evaluates to a constant subquery, an attacker can trigger a time‑based blind oracle and retrieve sensitive patient records and bcrypt hashes stored in the users_secure table. This SQL injection can lead to confidential data exposure and credential compromise.

This flaw affects all OpenEMR installations running a version earlier than 8.3.0. The product affected is the OpenEMR application, provided by the openemr vendor, common to hospitals, clinics, and health‑care providers that rely on this open‑source electronic medical record system.

The flaw carries a CVSS score of 9.4, indicating a critical severity. While advanced exploitation requires an authenticated session, the low privilege level needed and the time‑based extraction capability make the attack relatively simple for an attacker who gains valid login credentials. Because the EPSS value is currently unavailable and the issue is not listed in the CISA KEV catalog, no known widespread exploitation has been reported, but the high severity rating justifies rapid remediation.