PT-2026-30486 · C4G+1 · Basic Laboratory Information System+1

Carlos Avila · CVE-2019-25678 · Published 2026-04-05 · Updated 2026-04-05

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions C4G Basic Laboratory Information System version 3.4

Description Multiple SQL injection flaws allow unauthenticated attackers to execute arbitrary SQL commands. This is achieved by injecting malicious code through the site parameter via GET requests sent to the 'users select.php' endpoint. This can lead to the extraction of sensitive database information, such as system credentials and patient records.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the site parameter in the 'users select.php' endpoint until the issue is resolved.

Exploit

SQL injection

Missing Authentication

Weakness Enumeration

CWE-89

CWE-306

Related Identifiers

CVE-2019-25678

Affected Products

Basic Laboratory Information System

Computing For Good'S Basic Laboratory Information System

References · 3

• 🔥 https://exploit-db.com/exploits/46438 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25678 · Security Note
• https://vulncheck.com/advisories/c4g-blis-sql-injection-via-users-select-php · Note