CVE-2021-32104
📋 TL;DR
This SQL injection vulnerability in OpenEMR's eye examination form interface allows authenticated users to execute arbitrary SQL commands on the database. It affects OpenEMR installations running version 5.0.2.1, potentially compromising patient health records and system integrity.
💻 Affected Systems
- OpenEMR
📦 What is this software?
Openemr by Open Emr
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to patient data theft, record manipulation, or full system takeover via SQL injection to command execution escalation.
Likely Case
Unauthorized access to sensitive patient health records, modification of medical data, or privilege escalation within the OpenEMR system.
If Mitigated
Limited impact if proper input validation and database permissions restrict user privileges, though SQL injection could still expose some data.
🎯 Exploit Status
SQL injection is well-documented and can be exploited with standard tools; requires user authentication but minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OpenEMR 5.0.2 Patch 5
Vendor Advisory: https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431
Restart Required: No
Instructions:
1. Download OpenEMR 5.0.2 Patch 5 from the OpenEMR website. 2. Apply the patch following OpenEMR's patching instructions. 3. Verify the fix by checking that interface/forms/eye_mag/save.php has been updated.
🔧 Temporary Workarounds
Disable Eye Examination Module
linuxTemporarily disable the vulnerable eye examination form interface to prevent exploitation.
mv interface/forms/eye_mag/save.php interface/forms/eye_mag/save.php.disabled
Web Application Firewall Rules
allImplement WAF rules to block SQL injection patterns targeting the vulnerable endpoint.
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in the save.php file.
- Restrict database user permissions to minimize potential damage from SQL injection.
🔍 How to Verify
Check if Vulnerable:
Check if interface/forms/eye_mag/save.php exists in OpenEMR installation and review code for lack of parameterized queries.Check Version:
grep 'OpenEMR Version' openemr/version.phpVerify Fix Applied:
Verify that interface/forms/eye_mag/save.php has been updated with proper input sanitization or parameterized queries after patching.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by access to eye_mag forms
- HTTP requests to interface/forms/eye_mag/save.php with SQL syntax in parameters
Network Indicators:
- HTTP POST requests to /interface/forms/eye_mag/save.php containing SQL keywords like UNION, SELECT, INSERT
SIEM Query:
source="web_logs" AND url="/interface/forms/eye_mag/save.php" AND (query CONTAINS "UNION" OR query CONTAINS "SELECT" OR query CONTAINS "INSERT")🔗 References
- https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability
- https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431
- https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-risk/33592
- https://portswigger.net/daily-swig/healthcare-security-openemr-fixes-serious-flaws-that-lead-to-command-execution-in-patient-portal
- https://www.open-emr.org/wiki/index.php/Old_Outdated_OpenEMR_Patches
- https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerability
- https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431
- https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-risk/33592
- https://portswigger.net/daily-swig/healthcare-security-openemr-fixes-serious-flaws-that-lead-to-command-execution-in-patient-portal
- https://www.open-emr.org/wiki/index.php/Old_Outdated_OpenEMR_Patches
