GisLab Laboratory Management System
CVE-2026-8297
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable SQL injection (AV:N/AC:L/PR:N/UI:N) yields full database read/write and potential DoS, so C:H/I:H/A:H, matching the reported vector.
Primary rating from Vendor (TR-CERT).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection.
This issue affects GisLab Laboratory Management System: from 1.4.03 through 08072026.
AnalysisAI
SQL injection in GisLab Laboratory Management System (versions 1.4.03 through 08072026) allows remote unauthenticated attackers to inject arbitrary SQL commands via improperly neutralized special elements, per a TR-CERT advisory (TR-26-0573). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) indicates full compromise of the backend database with no authentication or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against reachable instances of GisLab Laboratory Management System, per CVSS AV:N/AC:L/PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point to high real-world severity: the CVSS 3.1 base score is 9.8 (Critical) with network attack vector, low complexity, no privileges, and no user interaction, and all three impact metrics rated High. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker locates an internet-exposed GisLab Laboratory Management System login or search endpoint, submits a crafted parameter containing SQL metacharacters, and manipulates the backend query to bypass authentication or dump database contents such as user credentials and laboratory records. Given AV:N/AC:L/PR:N/UI:N, this requires no account and no victim interaction, and could be scripted for reliability. … |
| Remediation | No specific vendor-released fix version was included in the available data (No vendor-released patch identified at time of analysis); consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0573 and contact the vendor directly for a patched build superseding 08072026. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all GisLab Laboratory Management System deployments currently running versions 1.4.03 through 08072026; isolate affected instances from public networks using firewall rules or network segmentation; enable comprehensive database access logging to detect suspicious query patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today