OpenEMR versions through 8.2.0 contain an authenticated SQL injection vulnerability in the backup configuration import feature. This flaw allows administrators with admin or super ACL privileges to execute arbitrary SQL statements by uploading a crafted SQL file. Exploitation can lead to unauthorized database modifications, extraction of credential hashes, creation of backdoor accounts, and arbitrary file writes if MySQL FILE privileges and permissive secure_file_priv settings are present.