Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector and low-privilege requirement match the CVSS 4.0 source; confidentiality-only impact reflects read-only SQL injection with no write or availability effect confirmed.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
In the "CheckUnitCodeAndKey.pl" service, the "validateOrgUnit" function is vulnerable to SQL injection.
AnalysisAI
SQL injection in CGM Clininet's CheckUnitCodeAndKey.pl Perl service allows authenticated low-privileged attackers on adjacent networks to extract sensitive hospital database records via the unparameterized validateOrgUnit function. Reported by CERT Poland, this flaw targets a hospital information system deployed in Polish healthcare institutions, making the confidentiality impact - likely patient and administrative data - disproportionately consequential relative to its numeric CVSS score. EPSS is 0.04% (12th percentile) and no active exploitation has been identified, but the healthcare context and lack of a confirmed patched version warrant prompt vendor engagement.
Technical ContextAI
CGM Clininet is a hospital information system (HIS) produced by CompuGroup Medical and deployed in Polish healthcare facilities. The vulnerable component is CheckUnitCodeAndKey.pl, a Perl CGI service, specifically its validateOrgUnit function, which constructs SQL queries using unsanitized caller-supplied input - a textbook CWE-89 (Improper Neutralization of Special Elements in an SQL Command) defect. The CVSS 4.0 vector specifies AV:A (Adjacent network), meaning the vulnerable service is reachable only from the same network segment, not the open internet. The impact is confined to VC:H (high confidentiality on the vulnerable system) with no integrity or availability impact, suggesting a read-only injection pattern such as UNION-based or blind extraction rather than destructive writes.
Affected ProductsAI
CGM Clininet, a hospital information system by CompuGroup Medical, is confirmed affected via the CERT Poland disclosure. No specific vulnerable version range is identified in the available data - affected versions are inferred solely from the NVD advisory and the CERT Poland report at https://cert.pl/en/posts/2026/03/CVE-2025-10350/. The product landing page is at https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html. Customers should contact CompuGroup Medical directly to determine which installed versions are in scope.
RemediationAI
No exact patched version has been confirmed in the available data. Customers should contact CompuGroup Medical and reference the CERT Poland advisory at https://cert.pl/en/posts/2026/03/CVE-2025-10350/ for vendor guidance on available fixes. As a compensating control, reinforcing the existing adjacent-network boundary through strict network segmentation - ensuring CheckUnitCodeAndKey.pl is reachable only by necessary internal hosts via firewall ACLs - reduces the attacker pool to those already inside the hospital LAN. Restricting low-privilege accounts to only necessary application roles limits the credential surface for pre-exploitation. A database activity monitoring (DAM) tool or WAF rule detecting anomalous SQL patterns on the Clininet service can provide detection capability. The definitive long-term fix requires CompuGroup Medical to replace string-concatenated SQL construction in validateOrgUnit with parameterized queries or prepared statements.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today