Description
C4G Basic Laboratory Information System 3.4 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by injecting malicious code through the site parameter. Attackers can send GET requests to the users_select.php endpoint with crafted SQL payloads to extract sensitive database information including patient records and system credentials.
Published: 2026-04-05
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection leading to data exposure
Action: Patch Immediately
AI Analysis

Impact

The vulnerability allows attackers to send crafted GET requests to the users_select.php endpoint, exploiting an SQL injection flaw that lets them execute arbitrary SQL commands. This can expose sensitive database contents, including patient records and system credentials, thereby compromising confidentiality.

Affected Systems

C4G Basic Laboratory Information System (BLIS) version 3.4 is affected; no later versions are listed.

Risk and Exploitability

The CVSS score of 8.8 classifies this as a high severity flaw. Attackers can exploit it remotely over the web without authentication, making it readily actionable. The EPSS score of 0.00059 (approximately <1%) indicates a very low exploitation likelihood, and the issue is not currently included in the CISA KEV catalog, but the high score and unauthenticated nature still indicate a significant risk of exploitation.

Generated by OpenCVE AI on April 21, 2026 at 00:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply vendor patch for C4G BLIS 3.4 to eliminate the SQL injection vulnerability.
  • If a patch is not yet released, block or disable the users_select.php endpoint and enforce authentication.
  • Implement a web application firewall rule to block SQL injection payloads targeting the site parameter.
  • Monitor web server logs for suspicious GET requests to users_select.php.

Generated by OpenCVE AI on April 21, 2026 at 00:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 20 Apr 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Gatech
Gatech computing For Good\'s Basic Laboratory Information System
Weaknesses CWE-89
CPEs cpe:2.3:a:gatech:computing_for_good\'s_basic_laboratory_information_system:*:*:*:*:*:*:*:*
Vendors & Products Gatech
Gatech computing For Good\'s Basic Laboratory Information System

Tue, 07 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
First Time appeared C4g
C4g basic Laboratory Information System
Vendors & Products C4g
C4g basic Laboratory Information System

Mon, 06 Apr 2026 16:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Apr 2026 20:45:00 +0000

Type Values Removed Values Added
Description C4G Basic Laboratory Information System 3.4 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by injecting malicious code through the site parameter. Attackers can send GET requests to the users_select.php endpoint with crafted SQL payloads to extract sensitive database information including patient records and system credentials.
Title C4G BLIS 3.4 SQL Injection via users_select.php
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

C4g Basic Laboratory Information System
Gatech Computing For Good\'s Basic Laboratory Information System
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-04-06T15:08:02.506Z

Reserved: 2026-04-05T13:30:46.978Z

Link: CVE-2019-25678

cve-icon Vulnrichment

Updated: 2026-04-06T15:07:59.192Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-05T21:16:45.967

Modified: 2026-04-20T17:50:07.163

Link: CVE-2019-25678

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T00:15:16Z

Weaknesses