OpenEMR versions prior to 8.0.0.3 contain a bug where several variables in the MedEx recall/reminder processing code are concatenated directly into SQL queries without proper sanitization or parameterization, creating a classic SQL injection flaw (CWE-89). Exploitation could allow an attacker to read, modify, or delete data from the underlying database, potentially exposing confidential patient information or corrupting clinical records. The CVSS score of 5.9 indicates a moderate severity that should not be ignored in a healthcare setting.

The vulnerability affects the OpenEMR electronic health records platform. Any installation of version 8.0.0.2 or earlier is potentially compromised. Version 8.0.0.3 and later contain the necessary patch to eliminate the unsafe variable concatenations.

With a CVSS of 5.9 and an EPSS score of less than 1%, the likelihood of widespread exploitation is low, and it is not listed in the CISA KEV catalog. However, the attack vector is inferred to be through web interfaces that trigger MedEx recall or reminder processing, possibly requiring authenticated access. An attacker crafting malicious input into the relevant fields could inject arbitrary SQL commands into the backend database, provided they can reach the vulnerable endpoint. The mechanism relies on unsanitized inputs, which is a well-known, deterministic compromise path.