CVE-2019-25678
SQLi in Gatech Computing For Good\'S Basic Laboratory Information System ≤ 3.4
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2019-25678 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Gatech Computing For Good\'S Basic Laboratory Information System. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2019-25678 is a set of multiple SQL injection vulnerabilities (CWE-89, CWE-306) in C4G Basic Laboratory Information System version 3.4. The flaws allow attackers to inject malicious SQL code through the "site" parameter in the users_select.php endpoint, enabling execution of arbitrary SQL commands.
Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, base score 8.2). By sending crafted GET requests to the endpoint, they can extract sensitive database information, including patient records and system credentials.
Advisories and exploit details are available at https://www.exploit-db.com/exploits/46438 and https://www.vulncheck.com/advisories/c4g-blis-sql-injection-via-users-select-php. An exploit is publicly documented on Exploit-DB (ID 46438), indicating potential for real-world abuse targeting laboratory systems.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-20091
Vulnerability Data
C4G Basic Laboratory Information System 3.4 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by injecting malicious code through the site parameter. Attackers can send GET requests to the users_select.php endpoint with crafted SQL…
more
payloads to extract sensitive database information including patient records and system credentials.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated SQL injection in public-facing web app (users_select.php) directly enables remote arbitrary SQL execution and data exfiltration, mapping to T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection by requiring validation of the 'site' parameter in users_select.php to block malicious SQL payloads.
Mandates timely remediation of the specific SQL injection flaw in C4G Basic Laboratory Information System 3.4 through patching or code correction.
Boundary protection mechanisms like web application firewalls monitor and filter incoming GET requests to block SQL injection attempts on the vulnerable endpoint.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly requires authentication of users/services/hardware, which eliminates missing authentication for critical functions.
Secure SDLC practices directly target injection flaws during coding and review so largely prevent CWE-89 introduction, yet the single broad outcome leaves residual risk from incomplete neutralization techniques or missed edge cases.
Managing identities and credentials is a prerequisite for authentication but does not itself enforce it on critical functions.
Defining and enforcing authorizations assumes prior authentication and therefore only partially mitigates the absence of authentication.
Training raises developer awareness of SQLi risks and can reduce introduction likelihood (partial) but removes none of the actual coding flaw's risk by itself since technical neutralization is still required.
Protecting networks from unauthorized access can be undermined by missing authentication but does not address the root authentication gap.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The control explicitly calls for authentication before any critical function is reached, eliminating the possibility of bypassing authentication for high-value operations.
The same secure-coding and static-analysis activities surface missing neutralization of SQL metacharacters before the system is accepted.
Early warnings and shared best-practice information help organizations apply the latest remediation techniques against SQL-injection vulnerabilities.
Threat-intelligence feeds that surface new SQL-injection campaigns enable rapid updates to query-construction defenses and detection signatures before exploitation occurs.
Mandating authentication requirements for critical functions at the requirements-gathering stage ensures that essential operations are not left unprotected by missing login or verification mechanisms.
Mandating authentication for network services and critical functions stops attackers from invoking sensitive operations without credentials, closing gaps where authentication is absent for important capabilities.