OpenEMR's Immunization Search/Report accepts a patient_id parameter that is directly concatenated into a SQL WHERE clause. Because no parameterization or escaping is performed, any authenticated user can append arbitrary SQL code. The vulnerability enables complete database compromise, exposing protected health information, user credentials, and, in some configurations, can lead to remote code execution.

The flaw exists in the OpenEMR application, affecting all installations running any version prior to 8.0.0.

The vulnerability carries a CVSS v3.1 score of 7.4 and an EPSS of less than 1 %, indicating a low current exploitation probability but not negligible. It is not listed in the CISA KEV catalog. The likely attack vector requires authentication to the web interface; an attacker can craft a malicious patient_id value in the query string or form submission to trigger the injection. Successful exploitation can read or modify the entire database, exfiltrate PHI, steal credentials, and potentially execute code if the database credentials are high privilege.