The flaw lies in the Patient REST API where the _sort parameter is concatenated directly into an ORDER BY clause without validation, enabling an authenticated API user to inject arbitrary SQL. This injection can lead to unrestricted database access, the disclosure of protected health information, and possible compromise of user credentials.

OpenEMR systems running any version earlier than 8.0.0 are affected. Version 8.0.0 and later contain the fix that properly escapes or validates the sort field names.

The vulnerability carries a CVSS score of 10, classifying it as critical. Its EPSS score falls below 1%, indicating a low exploitation probability, and it is not listed in the CISA KEV catalogue. The likely attack vector requires authentication to the OpenEMR API, so the threat vector is inferred to be a legitimate user or insider acting maliciously, though external exploitation could occur if API credentials are compromised. The exploitation path is straightforward: the attacker supplies a crafted _sort value that injects arbitrary SQL commands, bypassing normal access controls and enabling data extraction or manipulation.