OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php) that allows authen…

OpenEMR versions through 8.2.0 contain a critical remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php). Authenticated administrators can exploit the flaw by injecting PHP payloads into the categories database table via arbitrary SQL execution, altering the id column type to VARCHAR to facilitate payload insertion. The malicious PHP payload is subsequently executed through an unsanitized eval() call whenever any page instantiates the CategoryTree class. This means the exploitation impact extends beyond the initial admin-level access, as the payload is triggered even by unauthenticated or low-privilege page requests. Successful exploitation results in arbitrary OS command execution as the web server user. The vulnerability chains SQL injection with eval-based PHP code injection, making it particularly severe. It represents a significant risk for healthcare environments using OpenEMR, potentially exposing sensitive patient data and critical systems.