# CVE-2026-29187 - SQL Injection Vulnerability in new search popup
> Weakness CWE-89
>> Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
>> The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. Learn more on MITRE.
### Summary
OpenEMR <8.0.0.3 contains a SQL injection vulnerability in the new search popup that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the new search popup functionality.
### Details
The vulnerability occurs in the new search popup functionality where user-supplied input in the select relevance column and where condition is directly concatenated into SQL queries without proper sanitization. This allows attackers to inject malicious SQL code.
The vulnerability affects the following lines:
- `interface/new/new_search_popup.php` [line 141](https://github.com/openemr/openemr/blob/7f27cbd146104b9adaffc4be3bd1185c28505873/interface/new/new_search_popup.php#L141)
- `interface/new/new_search_popup.php` line [134](https://github.com/openemr/openemr/blob/7f27cbd146104b9adaffc4be3bd1185c28505873/interface/new/new_search_popup.php#L134) and [136](https://github.com/openemr/openemr/blob/7f27cbd146104b9adaffc4be3bd1185c28505873/interface/new/new_search_popup.php#L136)
- `interface/new/new_search_popup.php` line [125](https://github.com/openemr/openemr/blob/7f27cbd146104b9adaffc4be3bd1185c28505873/interface/new/new_search_popup.php#L125) and [128](https://github.com/openemr/openemr/blob/7f27cbd146104b9adaffc4be3bd1185c28505873/interface/new/new_search_popup.php#L128)
```php
foreach ($_REQUEST as $key => $value) {
if (!str_starts_with((string) $key, 'mf_')) {
continue; // "match field"
}
$fldname = substr((string) $key, 3);
// pubpid requires special treatment. Match on that is fatal.
if ($fldname == 'pubpid') {
$relevance .= " + 1000 * ( " . add_escape_custom($fldname) . " LIKE ? )";
array_push($sqlBindArray, $value);
} else {
$relevance .= " + ( " . add_escape_custom($fldname) . " LIKE ? )";
array_push($sqlBindArray, $value);
}
$where .= " OR " . add_escape_custom($fldname) . " LIKE ?";
array_push($sqlBindArraySpecial, $value);
echo "\n";
++$numfields;
}
$sql = "SELECT *, ( $relevance ) AS relevance, " .
"DATE_FORMAT(DOB,'%m/%d/%Y') as DOB_TS " .
"FROM patient_data WHERE $where " .
"ORDER BY relevance DESC, lname, fname, mname " .
"LIMIT " . escape_limit($fstart) . ", " . escape_limit($MAXSHOW) . "";
$sqlBindArray = array_merge($sqlBindArray, $sqlBindArraySpecial);
$rez = sqlStatement($sql, $sqlBindArray);
```
```sql
SELECT *, ( 0 + ( LIKE ? ) ) AS relevance, DATE_FORMAT(DOB,'%m/%d/%Y') as DOB_TS FROM patient_data WHERE 1 = 0 OR LIKE ? ORDER BY relevance DESC, lname, fname, mname LIMIT 0, 100
```
### PoC
```
┌──(kali㉿kali)-[~]
└─$ curl -k -b "OpenEMR=5cb438753a9513cb01f5adc257ab474f" 'https://172.18.0.3/interface/new/new_search_popup.php?mf_"=test'