CVE-2019-25678 Details
Description
C4G Basic Laboratory Information System 3.4 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by injecting malicious code through the site parameter. Attackers can send GET requests to the users_select.php endpoint with crafted SQL payloads to extract sensitive database information including patient records and system credentials.
C4G Basic Laboratory Information System (BLIS) version 3.4 is vulnerable to multiple SQL injection attacks. These vulnerabilities allow unauthenticated attackers to execute arbitrary SQL commands by injecting malicious payloads through the 'site' parameter. The exploitation occurs via GET requests to the 'users_select.php' endpoint, enabling attackers to extract sensitive database information such as patient records and system credentials.
It is recommended to validate application inputs properly to prevent SQL injection vulnerabilities. This can be done by using prepared statements and parameterized queries to ensure that user input is not executed as part of a SQL command.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.exploit-db.com/exploits/46438 | [email protected] | ExploitVDB Entry |
| https://www.vulncheck.com/advisories/c4g-blis-sql-injection-via-users-select-php | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gatech computing for good's basic laboratory information system | <= 3.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Apr 5, 2026 | New CVE Received | [email protected] |