CVE-2019-25728 - Care2x 2.7 Hospital Information System SQL Injection via ck_config

Back Back to CVE browser

HIGH

Care2x 2.7 Hospital Information System SQL Injection via ck_config

Published Jun 4, 2026

8.8

HIGH

CVSS 4.0

EPSS 0.26%

Description

Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL commands by manipulating the ck_config cookie parameter. Attackers can inject malicious SQL through the ck_config cookie in multiple endpoints including login.php, indexframe.php, and various module files to extract sensitive database information without authentication.

Affected products

Vendor Care2x Product Care2x Default
n/a
- Version
  2.7
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Care2x

n/a

Version	Status	Constraints
2.7	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-20164
Advisory
https://www.exploit-db.com/exploits/46268
exploit
https://www.vulncheck.com/advisories/care2x-hospital-information-system-sql-injection-via-ck-config
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-20164		Advisory
https://www.exploit-db.com/exploits/46268		exploit
https://www.vulncheck.com/advisories/care2x-hospital-information-system-sql-injection-via-ck-config		third-party-advisory