An unauthenticated SQL injection vulnerability in C4G Basic Laboratory Information System 3.4 poses a critical risk to patient data and system integrity.

The application fails to properly sanitize user-supplied input in the site parameter of the users_select.php file. This allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database through GET requests.

Successful exploitation of this flaw allows unauthorized actors to query, modify, or delete database content, leading to the potential exposure of sensitive patient records and system credentials. Given the CVSS score of 8.2, this vulnerability represents a high-severity risk that could result in significant data breaches and regulatory non-compliance. The ability for an unauthenticated attacker to interact directly with the database poses a severe threat to the confidentiality and availability of the laboratory information system.

Immediate Action: As no official patch is currently available, administrators should restrict network access to the affected web application, specifically the /ajax/users_select.php endpoint, to trusted IP ranges only.

Proactive Monitoring: Review web server and database access logs for anomalous GET requests containing SQL syntax, such as UNION or SLEEP commands, directed at the users_select.php script.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection patterns in URL parameters to mitigate the risk of exploitation.

Public Exploit Available: Yes, a published proof-of-concept exists in the Exploit-DB (EDB-ID: 46438).

Given the availability of a public exploit and the sensitive nature of the data managed by the C4G Basic Laboratory Information System, the risk must be addressed immediately. Organizations currently running version 3.4 should isolate the system from public-facing networks and implement strict WAF filtering until a vendor-provided security update is released and applied.