The vulnerability is a blind Boolean‑based SQL injection located in the Patient Search feature (/interface/new/new_search_popup.php). Attackers can manipulate the names of HTTP parameters instead of their values, causing the application to construct SQL statements from these keys. This flaw enables attackers to execute arbitrary SQL commands against the database, potentially extracting, modifying, or deleting patient records. The likely attack vector is an authenticated user who can access the patient search page, as the flaw exists only when authenticated credentials are present.

The affected product is OpenEMR, distributed by openemr. All releases prior to version 8.0.0.3 are vulnerable. The issued patch is included in release 8.0.0.3, which removes the vulnerable code path.

The CVSS base score of 8.1 indicates high severity, and an EPSS score of less than 1% suggests the probability of exploitation is low at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated session with access to the patient search interface; no privilege escalation beyond the existing user level is necessary. Successful exploitation would compromise the confidentiality and integrity of the database, allowing attackers to read, modify, or delete sensitive medical information.