OpenEMR’s PostCalendar module contains a blind SQL injection flaw in the categoriesUpdate administrative function. The function reads the ‘dels’ POST parameter with a routine that only strips HTML tags, then directly inserts the unescaped value into a raw SQL DELETE statement executed by Doctrine DBAL. Because the query is built without any escaping or parameterization, an attacker could inject additional SQL code, corrupting or deleting calendar categories and any related data. The compromised data could include appointment information and other user‑generated records, undermining the integrity of the electronic health record system.

All OpenEMR installations that use the PostCalendar module and run any version older than 8.0.0.3 are affected. The vulnerability resides in the administrative category update path of the OpenEMR application as shipped by the openemr vendor.

The CVSS score of 7.2 indicates high severity, while the EPSS score of less than 1% suggests that automated exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires authenticated administrative access to the PostCalendar module; thus it is considered a targeted threat that can be leveraged by an attacker who obtains or compromises such credentials to delete critical data or disrupt service.