CVE-2019-25728 - CVE House
Back to Database
Status published High CVE-2019-25728

Care2x 2.7 Hospital Information System SQL Injection via ck_config

Vulnerability Description

Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by manipulating the ck_config cookie parameter. Attackers can inject malicious SQL through the ck_config cookie in multiple endpoints including login.php, indexframe.php, and various module files to extract sensitive database information without authentication.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-25728

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Carlos Avila

References

More from care2x

View All →
CVE-2021-36352
Stored cross-site scripting (XSS) vulnerability in Care2x Hospital Information Management...
Medium 5.4
CVE-2021-36351
SQL Injection Vulnerability in Care2x Open Source Hospital Information Management...
Critical 9.8
CVE-2007-5418
Multiple PHP remote file inclusion vulnerabilities in CARE2X 2G 2.2...
High 7.5
CVE-2007-1574
CARE2X 2.2, and possibly earlier, allows remote attackers to obtain...
Medium 5
CVE-2007-1458
Multiple PHP remote file inclusion vulnerabilities in CARE2X 1.1 allow...
Medium 6.8

Affected Vendor

Affected Software

Care2x
Vulnerable Versions:
2.7

Timeline

Official Publish: June 4th, 2026
Last Modified: June 4th, 2026
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact