Home

Description

C4G Basic Laboratory Information System 3.4 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by injecting malicious code through the site parameter. Attackers can send GET requests to the users_select.php endpoint with crafted SQL payloads to extract sensitive database information including patient records and system credentials.

PUBLISHED Reserved 2026-04-05 | Published 2026-04-05 | Updated 2026-04-06 | Assigner VulnCheck




HIGH: 8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
HIGH: 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Problem types

Missing Authentication for Critical Function

Product status

3.4
affected

Credits

Carlos Avila finder

References

www.exploit-db.com/exploits/46438 (ExploitDB-46438) exploit

www.vulncheck.com/...blis-sql-injection-via-users-select-php (VulnCheck Advisory: C4G BLIS 3.4 SQL Injection via users_select.php) third-party-advisory

cve.org (CVE-2019-25678)

nvd.nist.gov (CVE-2019-25678)

Download JSON