Technical impact
OpenEMR versions through 8.2.0 contain an authenticated SQL injection flaw in the backup configuration import feature of backup.php. The vulnerability allows users with administrative or super‑ACL rights to upload a specially crafted SQL file, which is then executed by an unfiltered shell_exec call to the MySQL client. As a result, attackers can run arbitrary DDL and DML statements, extract credential hashes, alter access control tables, create backdoor accounts, deploy persistent triggers or stored procedures, and write files to the filesystem when MySQL FILE privileges and permissive secure_file_priv settings are present.
Affected Systems
The product affected is OpenEMR, and the flaw applies to all installations up to and including version 8.2.0. Only accounts that possess administrative or super privileges can trigger the import path, so the issue is limited to users with high‑level access within the application.
Risk and Exploitability
The vulnerability scores an 8.6 on the CVSS scale, indicating a high‑severity impact. EPSS data are not available, so the current likelihood of exploitation cannot be quantified, and the flaw is not listed in the CISA KEV catalog. Attackers must first authenticate as an administrator or super user and then upload a malicious file via the backup.php import form; the exploitation requires MySQL FILE privileges and a permissive secure_file_priv setting to achieve file write or command execution effects.
