CVE-2026-33914: 
OpenEMR vulnerability analysis and mitigation

CVE-2026-33914 is a blind SQL injection vulnerability in the PostCalendar module of OpenEMR, a widely used open-source electronic health records (EHR) and medical practice management application. The flaw resides in the categoriesUpdate administrative function, where the dels POST parameter is interpolated unsanitized into a raw SQL DELETE statement. All OpenEMR versions prior to 8.0.0.3 are affected. The vulnerability was disclosed on March 25–26, 2026, and patched in version 8.0.0.3 released the same day. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, Red Hat CVE).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The root cause lies in three compounding design failures in the legacy PostCalendar module: (1) pnVarCleanFromInput() — a PostNuke-era HTML sanitizer — is used to process the dels parameter but only strips HTML tags, leaving SQL special characters (single quotes, double dashes, semicolons, parentheses) intact; (2) the sanitized value is directly concatenated into a raw SQL DELETE FROM postcalendar_categories WHERE pc_catid IN ($dels) string without any escaping; and (3) Doctrine DBAL's executeStatement() is called with this pre-built string rather than a parameterized query, negating any ORM-level protection. Exploitation requires network access and authenticated administrator credentials, targeting the endpoint /interface/main/calendar/index.php?module=PostCalendar&type=admin&func=categoriesUpdate via a crafted POST request to the dels parameter. A fully functional Python PoC using time-based blind SQL injection is publicly available (GitHub Advisory, Patch Commit).

Successful exploitation allows an authenticated administrator to inject arbitrary SQL commands into the OpenEMR database, enabling time-based blind data extraction (including sensitive patient health records, credentials, and configuration data), deletion of arbitrary database rows via subquery manipulation, and potentially stacked queries depending on the DBAL driver configuration. Given that OpenEMR stores protected health information (PHI), exploitation could result in significant confidentiality, integrity, and availability impacts — including unauthorized access to patient records, data manipulation, and database disruption. The scope is limited to the database layer of the affected OpenEMR instance, but lateral movement within the database (e.g., reading password hashes from users_secure) is feasible (GitHub Advisory).

A fully functional Python PoC exploit script is publicly available in the GitHub Security Advisory, implementing SLEEP-based blind SQL injection with character-by-character data exfiltration against live OpenEMR instances (GitHub Advisory). Exploitation requires high privileges (administrator-level authentication), which limits the attack surface but does not eliminate risk in environments with compromised or shared admin credentials. As of the time of disclosure, there is no confirmed evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.027% (0.000270), indicating a currently low probability of widespread exploitation (Feedly).

1. Reconnaissance: Identify internet-facing OpenEMR instances running versions prior to 8.0.0.3 using tools like Shodan or Censys, searching for OpenEMR login pages.
2. Authentication: Obtain or compromise administrator credentials for the target OpenEMR instance. Authenticate via POST to /interface/main/main_screen.php?auth=login&site=default with valid authUser and clearPass parameters to establish a session.
3. Confirm injectability: Send a timing probe to the vulnerable endpoint: POST /interface/main/calendar/index.php?module=PostCalendar&type=admin&func=categoriesUpdate with dels=99999) OR SLEEP(3)-- -. A response delay of ~3 seconds confirms the endpoint is injectable.
4. Construct blind SQLi payload: Build a time-based payload to extract data character by character, e.g., dels=99999) OR (SLEEP(1) AND ASCII(SUBSTRING((SELECT user()),1,1))=ASCII('r'))-- -. Iterate over positions and characters to reconstruct the target string.
5. Extract sensitive data: Use the PoC script to dump database metadata (SELECT database(), SELECT user(), SELECT version()) or sensitive records such as password hashes (SELECT password FROM users_secure WHERE username='admin' LIMIT 1).
6. Post-exploitation: Use extracted credentials or database access to escalate privileges, access patient PHI, or pivot to other systems accessible from the database server (GitHub Advisory).

• Network: Unusual or repeated POST requests to /interface/main/calendar/index.php?module=PostCalendar&type=admin&func=categoriesUpdate from unexpected source IPs; requests with abnormally long or structured dels parameter values containing SQL keywords (SLEEP, OR, UNION, SELECT, ASCII, SUBSTRING).
• Logs: Web server access logs showing POST requests to the PostCalendar categoriesUpdate endpoint with dels values containing SQL syntax; application logs showing delayed query execution times consistent with SLEEP()-based injection; authentication events for the admin account from unusual IPs or at unusual times.
• Database: Unexpected or anomalous DELETE queries against postcalendar_categories with complex WHERE clauses; database slow query logs showing queries with SLEEP() calls; evidence of data reads from sensitive tables (e.g., users_secure) not associated with normal application activity.
• Process: Unusual database process activity with long-running queries originating from the OpenEMR web process (GitHub Advisory).

Upgrade OpenEMR to version 8.0.0.3 or later, which patches the vulnerability by casting all values in the dels parameter to integers via array_map(intval(...), explode(',', $dels)) before interpolation, effectively whitelisting only numeric IDs (OpenEMR Release, Patch Commit). As a temporary workaround if immediate upgrade is not possible, restrict network access to the PostCalendar administrative interface to trusted IP addresses only, and enforce the principle of least privilege by limiting administrator account access. Monitor PostCalendar administrative activity in web server and database logs for suspicious SQL patterns.

The vulnerability was reported by researcher herombey and remediated by OpenEMR developer kojiromike, with the advisory published by adunsulag on March 25, 2026 (GitHub Advisory). The release of version 8.0.0.3 addressed multiple high-severity issues simultaneously, suggesting a coordinated security release cycle. Coverage appeared on vulnerability aggregators and security blogs including infinitsec.net and cyberhub.blog shortly after disclosure, reflecting routine community tracking of OpenEMR security issues given its use in healthcare environments.