CVE-2019-25678
HIGH EPSS 18.9%
Published Apr 5, 20262mo ago · Modified Jun 17, 20261w ago
8.8 CVSS 4.0
Published Apr 5, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago
Description
C4G Basic Laboratory Information System 3.4 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by injecting malicious code through the site parameter. Attackers can send GET requests to the users_select.php endpoint with crafted SQL payloads to extract sensitive database information including patient records and system credentials.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
18.9% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available
Weaknesses 2
CWE-306 Missing Authentication for Critical Function Authentication
CWE-89 SQL Injection Injection
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| gatech | computing_for_good\'s_basic_laboratory_information_system | * | ≤3.4 |
References 2
- exploit-db.com https://www.exploit-db.com/exploits/46438
- vulncheck.com https://www.vulncheck.com/advisories/c4g-blis-sql-injection-via-users-select-php
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.