PT-2026-21315 · Unknown · Labcollector

Carlos Avila · Publicado 2026-02-20 · Atualizado 2026-02-20 · CVE-2019-25438

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LabCollector version 5.423

Description LabCollector version 5.423 has multiple SQL injection flaws. Unauthenticated attackers can execute arbitrary SQL commands by injecting malicious code through POST parameters. Attackers can submit crafted SQL payloads in the login parameter of the ''login.php'' endpoint or the user name parameter of the ''retrieve password.php'' endpoint to extract sensitive database information without authentication.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the ''login.php'' and ''retrieve password.php'' endpoints. Sanitize the login parameter in ''login.php'' to prevent SQL injection. Sanitize the user name parameter in ''retrieve password.php'' to prevent SQL injection.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2019-25438

Produtos afetados

Labcollector

Referências · 5

• 🔥 https://exploit-db.com/exploits/47460 · Exploit
• https://vulncheck.com/advisories/labcollector-sql-injection-via-loginphp · Nota
• https://osv.dev/vulnerability/CVE-2019-25438 · Aviso do Fabricante
• https://labcollector.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25438 · Nota de Segurança