Executive brief
Care2x, an open-source hospital information system used for managing patient records and clinical workflows, is vulnerable to a security flaw that allows unauthorized individuals to access its database. By sending specially crafted requests, an attacker can bypass security controls to view sensitive medical and administrative information without needing a username or password. This could lead to a significant breach of patient privacy and data integrity.
Technical details
Care2x 2.7 is vulnerable to multiple SQL injection flaws, primarily through the 'ck_config' cookie parameter. The vulnerability exists because the application fails to properly sanitize or parameterize inputs before using them in SQL queries across several endpoints, including login.php, indexframe.php, and various modules like ambulatory and laboratory. An unauthenticated remote attacker can exploit this by injecting malicious SQL syntax into the cookie, allowing for the extraction of sensitive database information, including user credentials and patient records. The issue is confirmed to affect environments running PHP 5.x and MySQL. No official patch is documented in the advisory, though input validation across all classes is recommended.
Affected products
- Care2x Care2x 2.7
Timeline
- 2019-01-17: disclosed: Vulnerability discovered by researcher Carlos Avila
- 2019-01-28: other: Exploit published on Exploit-DB
- 2026-06-04: advisory: CVE-2019-25728 published/updated in NVD