CVE-2020-29140: 
OpenEMR vulnerability analysis and mitigation

A SQL injection vulnerability was discovered in OpenEMR versions before 5.0.2.5, specifically in the interface/reports/immunization_report.php file. The vulnerability allows a remote authenticated attacker to execute arbitrary SQL commands via the form_code parameter (NVD, Murat Blog).

The vulnerability exists due to ineffective use of the add_escape_custom() function in interface/reports/immunization_report.php line 129. The function is a wrapper for mysqli_real_escape_string(), but its result is not properly enclosed in quotes, leading to SQL injection possibilities. The vulnerability has a CVSS v3.1 Base Score of 7.2 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) (NVD, NitroTeam).

A successful exploitation of this vulnerability could allow an authenticated attacker to execute arbitrary SQL commands on the database server. This could potentially lead to unauthorized access to sensitive medical information, manipulation of database contents, and compromise of the system's integrity (NVD).

The vulnerability requires authentication and can be exploited by sending a specially crafted POST request to the immunization_report.php endpoint with a malicious form_code parameter. The vulnerability has been confirmed to be exploitable on Windows 10 with Apache 2.4, MariaDB 10.3.22, and PHP versions 7.1.33 (OpenEMR 5.0.2(5)) and PHP 7.4 (OpenEMR 6.0.0-dev) (Murat Blog).

The vulnerability has been patched in OpenEMR version 5.0.2.5. Users are strongly recommended to upgrade to this version or later. The fix was released on January 7, 2021, as part of a security update (OpenEMR Downloads, OpenEMR Patches).

The vulnerability was discovered by Kutlymurat Mambetniyazov of NitroTeam.kz and was responsibly disclosed to the vendor. The OpenEMR team responded promptly to the report and released a patch within approximately six weeks of the initial disclosure (Murat Blog).