OpenEMR Fee Sheet SQL Injection Vulnerability

OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDrug).

The flaw interpolates the prod[N][warehouse] POST field into an ORDER BY clause.

• Affected versions: OpenEMR before 8.3.0
• Preconditions: Low-privileged authenticated users can submit Fee Sheet product lines
• Impact: Time-based blind oracle can extract patient data and users_secure bcrypt hashes