PT-2026-21315 · Unknown · Labcollector

Carlos Avila · Published 2026-02-20 · Updated 2026-02-20 · CVE-2019-25438

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LabCollector version 5.423

Description LabCollector version 5.423 has multiple SQL injection flaws. Unauthenticated attackers can execute arbitrary SQL commands by injecting malicious code through POST parameters. Attackers can submit crafted SQL payloads in the login parameter of the ''login.php'' endpoint or the user name parameter of the ''retrieve password.php'' endpoint to extract sensitive database information without authentication.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the ''login.php'' and ''retrieve password.php'' endpoints. Sanitize the login parameter in ''login.php'' to prevent SQL injection. Sanitize the user name parameter in ''retrieve password.php'' to prevent SQL injection.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2019-25438

Affected Products

Labcollector

References · 5

• 🔥 https://exploit-db.com/exploits/47460 · Exploit
• https://osv.dev/vulnerability/CVE-2019-25438 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25438 · Security Note
• https://vulncheck.com/advisories/labcollector-sql-injection-via-loginphp · Note
• https://labcollector.com · Note