CVE-2019-25678 - Vulnerability Analysis

Overview

C4G Basic Laboratory Information System 3.4 contains multiple sql injection vulnerabilities caused by unsanitized input in the site parameter at users_select.php, letting unauthenticated attackers execute arbitrary SQL commands and extract sensitive data, exploit requires crafted GET requests.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary SQL commands to extract sensitive database information including patient records and system credentials.

Mitigation

Update to the latest version that patches these SQL injection vulnerabilities.

References

• https://www.exploit-db.com/exploits/46438
• https://www.vulncheck.com/advisories/c4g-blis-sql-injection-via-users-select-php

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner