CVE-2020-29139: 
OpenEMR vulnerability analysis and mitigation

A SQL injection vulnerability was discovered in OpenEMR before version 5.0.2.5, specifically in interface/main/finder/patient_select.php from library/patient.inc. The vulnerability allows remote authenticated attackers to execute arbitrary SQL commands via the searchFields parameter (NVD, Murat Blog).

The vulnerability stems from ineffective use of add_escape_custom() function in library/patient.inc line 648, where the filtered value is not properly enclosed in quotes: $where .= " " . add_escape_custom($val) . " like ? ";. The add_escape_custom() function is a wrapper for mysqli_real_escape_string(), but since the result is not enclosed in quotes, it leads to SQL injection possibility without quotes (Murat Blog, NitroTeam). The vulnerability has been assigned a CVSS v3.1 Base Score of 7.2 HIGH with vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability allows authenticated attackers with administrator privileges to execute arbitrary SQL commands, potentially leading to unauthorized access to sensitive patient data, modification of database contents, and compromise of database integrity (NVD).

The vulnerability requires administrator account access to exploit. It has been successfully tested on Windows 10 with Apache 2.4, MariaDB 10.3.22, PHP 7.1.33 for OpenEMR 5.0.2(5) and PHP 7.4 for OpenEMR 6.0.0-dev (Murat Blog).

The vulnerability has been patched in OpenEMR version 5.0.2.5. Users are strongly recommended to upgrade to this version or later to mitigate the risk (OpenEMR Downloads, NVD).

The vulnerability was responsibly disclosed to the vendor on November 24, 2020, and was quickly acknowledged. The OpenEMR team responded promptly by releasing a patch on January 7, 2021 (Murat Blog).