Description

NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-09-11T15:17:06.510Z",
  "pubdate": "2026-09-11T15:17:06.510Z",
  "executiveSummary": "NextGen Connect (Mirth Connect) versions 4.7.1 and earlier contain a critical vulnerability involving improper neutralization of special elements used in an SQL command, classified as SQL Injection.\nThe vulnerability resides within the Database Connector API, allowing an authenticated user to execute arbitrary SQL queries against the underlying database management system.\nSuccessful exploitation of this flaw can lead to severe consequences, including the unauthorized disclosure of sensitive information such as credentials for integrated systems, the capability to perform arbitrary file writes, and the execution of denial-of-service conditions.\nThis vulnerability is accessible to authenticated users, implying that any entity with legitimate system access can escalate privileges or manipulate backend data, posing a significant risk to the integrity, confidentiality, and availability of the health information exchange infrastructure.\nThere are no specific requirements for external network exposure other than the attacker maintaining an active authenticated session to interact with the vulnerable API component.",
  "technicalDetails": "The vulnerability originates from an improper validation process within the Database Connector API component in NextGen Connect versions 4.7.1 and earlier. The API fails to sanitize user-supplied input before incorporating it into dynamic SQL queries executed against the connected database.\nBecause the application dynamically constructs queries based on input provided through the connector interface, an authenticated attacker can inject malicious SQL syntax into the parameters processed by the API.\nThe attack flow begins with the adversary establishing an authenticated session within the Mirth Connect interface. Once authenticated, the attacker targets the Database Connector API, utilizing specially crafted input strings designed to break out of the intended query structure.\nBy manipulating the SQL command logic, the attacker can influence the database engine to execute unintended operations. This may include using UNION-based techniques to retrieve sensitive data from internal tables—specifically targeting stored credentials for downstream systems—or employing stacked queries if the database driver supports them.\nThe ability to perform arbitrary file writes often stems from abusing database-specific features or administrative functions (such as 'SELECT ... INTO OUTFILE' or similar capabilities depending on the backend engine), allowing the attacker to write files to the filesystem if the database service account has sufficient OS-level permissions. This could lead to remote code execution by placing a web shell within the application directory.\nDenial-of-service conditions are achieved by injecting resource-intensive queries or commands that lock critical database tables, purge essential configuration data, or crash the database service entirely. Because the injection point is within an API that serves as a core communication bridge for the software, the impact extends beyond the immediate database and compromises the reliability of the entire integration workflow.\nThe vulnerability is restricted to authenticated users; however, given the nature of the application, an attacker with low-level user access could leverage this flaw to gain administrative control over the underlying data or the server environment itself, bypassing standard application-level access controls."
}