External risk intelligence

OpenHIS SQL Injection in PayController Allows Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-46532

OpenHIS is a Hospital Information System, which typically functions as a web-based application. Since the vulnerability exists within a controller component handling payment/refund logic, it is likely to be part of a web interface accessible over a network, making it a common target for internet-facing deployment.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in OpenHIS, a hospital information system, that could allow unauthorized individuals to execute code remotely. This issue stems from a flaw in how payment and refund functions handle user input, potentially exposing system integrity and sensitive data. The primary concern is to confirm if our organization utilizes OpenHIS and assess the potential exposure.

Unchecked input in payment functions allows code execution.
Critical systems handling patient data require vigilance.
Confirm OpenHIS usage and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerability through the network without needing any special privileges. By interacting with the refund functionality within the PayController, they can trigger a SQL injection. This could allow them to run their own code on the system.

Requires network access.
Triggered via the refund function.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in the refund function of OpenHIS could allow an unauthenticated attacker to execute arbitrary code on the affected system by manipulating input to the PayController.class.php component. This could impact the integrity and availability of the application's data and services.

System data and service behavior.
Via crafted network requests.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical SQL injection vulnerability in the OpenHIS refund function requires immediate attention from application owners and potentially the infrastructure or platform teams responsible for hosting it. The first practical step is to identify all instances of OpenHIS, confirm their reachability and criticality, and then assign ownership for remediation planning.

Application owners should own this issue.
Verify asset reachability and business criticality first.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenHIS?

OpenHIS is a Hospital Information System, which is software designed to manage administrative, clinical, and financial data within a healthcare facility. It typically functions as a web-based application, allowing staff to handle tasks like patient registration, medical records, and payment processing through a centralized digital interface.

What does CVE-2024-46532 mean?

This identifier refers to a SQL Injection vulnerability, classified as CWE-89. In plain terms, this means the software does not properly filter information provided by a user before processing it in a database query. Because of this flaw, an attacker can input malicious commands that the system mistakenly treats as legitimate instructions, potentially allowing them to run unauthorized code.

How is this vulnerability triggered?

The flaw is specifically triggered by interacting with the refund function located in the PayController.class.php component. An attacker must send a specially crafted network request to this specific function to exploit the input handling error. Simply using the software for unrelated tasks, such as standard record viewing or non-payment workflows, does not trigger this specific vulnerability.

Is my system at risk from this?

According to Halo Surface Signal, because OpenHIS is a web-based system and the flaw exists in a component that handles payments, it is commonly deployed in internet-facing configurations. If your instance is accessible over a network without restrictions, it is a likely target. Organizations running this software should prioritize verifying if their specific installation is reachable from the internet.

What should I do first to address this?

The initial step is to conduct a thorough inventory to identify every instance of OpenHIS running within your environment. Once identified, confirm the network accessibility and business criticality of each system. After you have a clear map of where the software exists and how it is connected, you can assign ownership to the appropriate technical teams to plan and implement necessary remediation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.