OpenEMR contains a CWE-89 SQL injection flaw in the ajax graphs library that permits an authenticated attacker to inject arbitrary SQL. The absence of proper input validation allows malicious queries to be executed against the database, potentially exposing sensitive patient information or altering records. The vulnerability is strictly limited to users who can authenticate to the system, so it does not grant unauthenticated access.

The issue affects installations of the OpenEMR electronic health records application that are running any version older than 8.0.0.1. The fix was introduced in release 8.0.0.1, so systems not yet updated remain vulnerable.

The CVSS score of 8.8 designates the flaw as high severity, but the EPSS score of less than 1 % suggests that exploitation is currently unlikely to be widespread. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed public exploitation. Attackers need legitimate credentials to reach the Ajax graphs endpoint, so the attack vector involves authenticated users submitting malicious payloads to that endpoint. The high severity combined with the sensitive nature of medical data means that, if exploited, the potential impact remains significant.