Technical impact
The vulnerability in OpenEMR allows authenticated administrators to inject PHP payloads into the categories database table, leading to arbitrary command execution on the server. It stems from an unsanitized eval() call in CategoryTree, classified as CWE-95. When exploited, the attacker can run any command as the web server user, compromising confidentiality, integrity, and availability of the entire application and underlying system.
Affected Systems
OpenEMR versions up to and including 8.2.0 are affected. The flaw resides in the document category tree component (library/classes/Tree.class.php) and can be triggered by a user with administrator privileges or a low-privilege user if the attacker can first modify the database via SQL injection.
Risk and Exploitability
The vulnerability scores a CVSS of 9.4, indicating very high severity, and is not listed in the CISA KEV catalog. The EPSS score is 2%, indicating a moderate likelihood of exploitation. The combination of required administrator privileges, SQL injection to alter the id column, and an eval() execution path suggests a high likelihood of exploitation in environments where the application is exposed to the internet. Attackers can chain SQL injection to set the id column to VARCHAR, insert malicious PHP, and trigger eval() on any page that loads CategoryTree, including unauthenticated pages. This results in command execution with web server privileges.
