CVE-2025-30059

Root

Cause

The getPerfServiceIds function within the PrepareCDExportJSON.pl service is vulnerable to SQL injection due to improper neutralization of user input. This flaw belongs to the broader class of injection weaknesses identified in CGM CLININET software [1].

Exploitation

An attacker can exploit this vulnerability by supplying crafted input to the vulnerable function, which is then incorporated into an SQL query without proper sanitization. No authentication is required if the service is exposed, but exploitation prerequisites depend on the deployment context [1].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands against the backend database. This can lead to unauthorized access, modification, or deletion of sensitive clinical data, potentially compromising patient information and system integrity [1].

Mitigation

CGM has released a fix in CLININET version 2025.MS1. Users should upgrade immediately. No workaround details are provided in the advisory [1].