Security readout for executives and security teams
Plain-English summary
CVE-2021-32104 is a SQL injection issue in OpenEMR 5.0.2.1. It requires user privileges, so the main concern is misuse through a compromised or malicious account. Because OpenEMR stores healthcare data, successful exploitation could affect sensitive patient records.
Executive priority
Treat this as a priority for healthcare environments because it affects an electronic medical record system and may put patient data at risk. Urgency is higher where OpenEMR 5.0.2.1 is still internet-accessible or broadly available to users.
Technical view
The CVE record identifies SQL injection in `interface/forms/eye_mag/save.php` in OpenEMR 5.0.2.1. The bundle does not provide CVSS, CWE, exploit details, or a vendor-fixed version for this CVE. References point to OpenEMR patch guidance and related SonarSource reporting on serious OpenEMR flaws.
Likely exposure
Organizations running OpenEMR 5.0.2.1, especially systems with the eye_mag form enabled and accounts with access to that workflow, should consider themselves potentially exposed.
Exploitation context
The source bundle says exploitation requires user privileges. It does not show CISA KEV listing, public exploitation, exploit maturity, or unauthenticated exposure evidence.
Researcher notes
Evidence is limited to the CVE description and related references. Do not assume unauthenticated exploitation, active exploitation, or a specific fixed version beyond checking OpenEMR’s patch and upgrade guidance.
Mitigation direction
- Identify any OpenEMR 5.0.2.1 deployments.
- Review OpenEMR vendor patch guidance for the 5.0.2 branch.
- Upgrade to a supported OpenEMR release where feasible.
- Restrict OpenEMR access to trusted networks and users.
- Review privileged and clinical user accounts for compromise.
Validation and detection
- Inventory OpenEMR versions across production and test systems.
- Check whether `interface/forms/eye_mag/save.php` exists on deployed systems.
- Review OpenEMR patch level against vendor guidance.
- Search logs for unusual activity by authenticated OpenEMR users.
- Confirm database access patterns match expected application behavior.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Database behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-32104 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://blog.sonarsource.com/openemr-5-0-2-1-command-injection-vulnerabilityCVE reference · x_refsource_MISC
- https://community.sonarsource.com/t/openemr-5-0-2-1-command-injection-vulnerability-puts-health-records-at-risk/33592CVE reference · x_refsource_MISC
- https://community.open-emr.org/t/openemr-5-0-2-patch-5-has-been-released/15431CVE reference · x_refsource_MISC
- https://portswigger.net/daily-swig/healthcare-security-openemr-fixes-serious-flaws-that-lead-to-command-execution-in-patient-portalCVE reference · x_refsource_MISC
- https://www.open-emr.org/wiki/index.php/Old_Outdated_OpenEMR_PatchesCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.