Executive brief
C4G Basic Laboratory Information System (BLIS) is an open-source platform used by medical laboratories to manage patient records, specimens, and test results. A security flaw allows unauthorized individuals to bypass security controls and access the underlying database. This could lead to the theft of sensitive patient data, medical records, and system administrator credentials, potentially compromising the privacy of patients and the integrity of laboratory operations.
Technical details
C4G Basic Laboratory Information System (BLIS) version 3.4 is vulnerable to multiple SQL injection flaws, most notably within the 'site' parameter of the users_select.php endpoint. The vulnerability stems from improper neutralization of user-supplied input and a lack of authentication for critical functions (CWE-89, CWE-306). An unauthenticated remote attacker can exploit this by sending specially crafted GET requests to the vulnerable endpoint. Successful exploitation allows for the execution of arbitrary SQL commands, enabling the attacker to extract sensitive information from the MySQL database, including patient records, system configurations, and user credentials. Proof-of-concept exploits using automated tools like sqlmap have been verified.
Affected products
- C4G Basic Laboratory Information System (BLIS) 3.4
Timeline
- 2019-01-31: other: Vulnerability discovered by researcher
- 2019-02-21: disclosed: Exploit published on Exploit-DB
- 2026-04-05: advisory: CVE-2019-25678 assigned and published by VulnCheck/NVD