The vulnerability in OpenEMR (up to version 8.2.0) resides in the document category tree component (library/classes/Tree.class.php). It allows authenticated administrators to perform arbitrary SQL commands to change the id column type to VARCHAR and insert PHP payloads into the categories table. These payloads are then executed through an unsanitized eval() call when the CategoryTree class is instantiated on any page, including those accessible without authentication or with low privileges. This leads to remote code execution with the privileges of the web server user. The CVSS 3.1 score is 9.1 (critical), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and complete confidentiality, integrity, and availability impact.

Successful exploitation results in remote code execution on the server hosting OpenEMR, executed with the web server's privileges. This can lead to full system compromise, data theft, or service disruption. The vulnerability affects confidentiality, integrity, and availability of the affected system. Since the payload execution occurs even on unauthenticated or low-privilege pages, the attack surface is significantly increased after initial administrator compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict administrator access to trusted personnel only and monitor for suspicious database changes. Consider disabling or restricting access to the document category tree component if feasible. Avoid exposing OpenEMR instances to untrusted networks without additional protective controls.