The vulnerability is caused by insufficient input validation in the ajax_save endpoint of the CAMOS form, allowing an attacker with authentication to inject arbitrary SQL statements. Based on the description, it is inferred that the injected code could read, modify, or delete database records, potentially exposing and altering protected health information.

All installations of OpenEMR older than version 8.0.0.3 are affected. The vulnerability exists in the core application and impacts any environment running those versions.

The CVSS base score of 8.8 indicates a high severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Based on the requirement for authentication, the attack vector is likely limited to users with authorized access within the system.