Critical SQL injection vulnerabilities within the Philips Tasy electronic medical records (EMR) system could allow attackers to exploit them remotely, leaking sensitive patient Personal Identifiable Information (PII), and Protected Health Information (PHI) according to a U.S. Cybersecurity and Infrastructure Security Agency (CISA) medical bulletin. Philips Tasy EMR is used by more than 950 healthcare institutions, and the system allows for centralized control and management of “clinical, organizational and administrative processes, including incorporating analytics, billing, and inventory and supply management for medical prescriptions.” The flaws, tracked as CVE-2021-39375 and CVE-2021-39376, both allow unauthorized attackers the ability to modify SQL database parameter commands, giving themselves access to the sensitive information stored within these databases, as well as being able to execute arbitrary commands. Although critical, these vulnerabilities aren’t accessible by outside attackers unless they are able to acquire the necessary credentials within the target systems. Attacks on the healthcare industry are becoming more prevalent all over the world, and the Ankura CTAPT will continue to provide our readers with actionable intelligence.