Healthcare Security Alert: Critical SQL Injection Vulnerability Patched in Bahmni Open-Source EMR
Executive Summary
A critical, high-severity SQL injection (SQLi) vulnerability has been identified and patched within Bahmni bahmnicore, the widely used open-source Electronic Medical Record (EMR) and hospital information system (HMIS). Tracked as CVE-2026-15477 and cataloged on July 12, 2026, the vulnerability affects all versions up to and including 0.93.
The flaw resides within the additionalParams function of the platform's Search Endpoint, located at /openmrs/ws/rest/v1/bahmnicore/sql. Exploiting this vulnerability enables remote, unauthenticated attackers to manipulate SQL queries through the test argument, allowing them to bypass authentication perimeters, exfiltrate sensitive protected health information (PHI), modify patient databases, or achieve full system compromise, presenting major data privacy and HIPAA compliance exposures for clinics, NGOs, and hospitals.
Deep-Dive Technical Analysis
Electronic Medical Record (EMR) and hospital management platforms act as central repositories for highly sensitive patient health directories, medical billing records, and doctor credentials. Because these databases contain valuable protected health information (PHI), they represent prime, high-value targets for both financially motivated cybercriminals executing double-extortion campaigns and identity-theft rings.
A technical and forensic analysis of the CVE-2026-15477 SQL injection vector reveals a critical input-handling failure inside the Bahmni core database-handling framework:
1. The Vulnerable API Endpoint: Bahmni bahmnicore provides a Search Endpoint at the API URL path /openmrs/ws/rest/v1/bahmnicore/sql to handle complex database queries.
2. The Lack of Input Sanitization: Within the platform's codebase, the additionalParams function is designed to process the test argument submitted in incoming HTTP requests. However, the function fails to validate or sanitize the input.
3. The Logical Flaw (Direct Concatenation): Rather than utilizing secure, parameterized SQL queries, the application directly concatenates the raw, unsanitized test string into the SQL query construction.
4. Remote Exploitation and Query Manipulation: A remote, unauthenticated attacker can transmit a crafted HTTP POST request containing malicious SQL parameters (such as ' OR 1=1; --) directly through the test argument.
5. The Operational Impact: Because the server executes the injected SQL commands with database-administrative privileges, the attacker can:
* Bypass all application-level authentication perimeters, logging into the administrative console.
* Execute bulk-extraction queries, downloading the entire patient medical records database (exposing names, diagnoses, prescriptions, and government IDs).
* Write malicious data, altering medical histories, tampering with allergy registries, or corrupting diagnostic logs.
* Delete entire database directories to disrupt hospital operations or execute ransomware extortion.
Because the exploit can be initiated remotely without any valid credentials or user interaction, the public release of proof-of-concept exploit code presents an extreme threat to all unpatched installations.
Industry Impact and Recommendations
The Bahmni EMR advisory highlights the severe, ongoing risk of SQL injection in critical medical software. When open-source platforms used in low-resource clinics and NGOs fail to enforce parameterized queries, they expose highly vulnerable patient populations to devastating identity theft and operational disruptions.
We recommend that all healthcare IT administrators, CISO boards, and NGO security coordinators implement the following immediate mitigations:
1. Upgrade Bahmni bahmnicore Immediately: Prioritize this security advisory without delay. Immediately upgrade your Bahmni installation to one of the patched, vendor-supported versions, including 0.93.1, 1.0.1, 1.1.1, 1.2.1, 1.3.1, or 2.0.1.
2. Enforce Rigid Input Parameterization and ORM: Ensure that all custom API endpoints, SQL search queries, and database-handling functions utilize strictly parameterized queries or secure Object-Relational Mapping (ORM) frameworks. Completely eliminate raw string concatenation in SQL construction.
3. Deploy a Web Application Firewall (WAF): Position an advanced Web Application Firewall (WAF) or an API Gateway in front of your EMR servers. Configure rules to detect and block common SQL injection strings, path-traversal patterns, and malformed API queries.
4. Audit Databases for Unauthorized Access: Conduct a comprehensive audit of all database access logs, SQL query histories, and API traffic logs. Scan for uncharacteristic bulk-export commands, anomalous SQL syntax, or unknown IP connections targeting the /openmrs/ directory.
References
* Tenable — CVE-2026-15477 | Tenable®
* VulDB — CVE-2026-15477 in bahmnicore - Vulnerability Database
* OpenMRS — Bahmni Security Advisory July 02, 2026 - OpenMRS Talk