CVE-2019-25678
Received Received - Intake
SQL Injection in C4G LIS 3.4 Exposes Sensitive Data

Publication date: 2026-04-05

Last updated on: 2026-04-20

Assigner: VulnCheck

Description
C4G Basic Laboratory Information System 3.4 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by injecting malicious code through the site parameter. Attackers can send GET requests to the users_select.php endpoint with crafted SQL payloads to extract sensitive database information including patient records and system credentials.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-05
Last Modified
2026-04-20
Generated
2026-06-16
AI Q&A
2026-04-06
EPSS Evaluated
2026-06-15
NVD
CVE-2019-25678
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
gatech computing_for_good's_basic_laboratory_information_system to 3.4 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2019-25678 is a vulnerability in C4G Basic Laboratory Information System version 3.4 that involves multiple SQL injection flaws. These flaws allow attackers who are not authenticated to inject malicious SQL code through the 'site' parameter by sending specially crafted GET requests to the users_select.php endpoint. This enables attackers to execute arbitrary SQL commands on the backend database.

As a result, attackers can extract sensitive information from the database, including patient records and system credentials.

Impact Analysis

This vulnerability can have serious impacts including unauthorized access to sensitive data such as patient records and system credentials. Because attackers can execute arbitrary SQL commands without authentication, they can potentially steal confidential information, compromise system integrity, and disrupt normal operations.

Compliance Impact

The vulnerability allows unauthenticated attackers to execute arbitrary SQL commands and extract sensitive database information, including patient records and system credentials.

This exposure of sensitive patient data can lead to non-compliance with data protection regulations such as GDPR and HIPAA, which mandate the protection of personal and health information.

Failure to protect such data could result in legal penalties, loss of trust, and other regulatory consequences.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2019-25678. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart