CVE-2026-9163 is an SQL injection in GIS Informatics GisLab Laboratory Management System, rated 9.8. It affects versions from 1.4.03 up to but not including 1.5. Upgrade to version 1.5 or later and confirm the fix against the Turkish national notice that the record points to.
What's affected
- Product: GisLab Laboratory Management System from GIS Informatics.
- Affected: from 1.4.03 before 1.5.
- Fixed: 1.5, based on the record's range. The notice could not be loaded in full when this post was reviewed, so confirm the fixed version with the vendor.
- Weakness: improper neutralization of special elements in an SQL command.
How to check if you're exposed
Read the application version from the GisLab admin or about screen, or ask the vendor which build you run. Any version at 1.4.03 or later but below 1.5 is in scope. Then check whether the application is reachable from the internet, because the vector needs no login.
What to do now
- Upgrade GisLab to 1.5 or later. Take a database backup first.
- If you cannot upgrade today, restrict access to the application to your internal network or a VPN.
- Review web server and database logs for unusual queries or errors since the application was exposed.
- Rotate database credentials the application uses if you see signs of misuse.
- Ask your vendor for the full advisory and any extra mitigation steps.
Why it matters
The record lists CWE-89. The application builds an SQL statement using input that has not been neutralized, so crafted input can change the meaning of the query. In a laboratory system that can mean reading or altering sample records and results, and depending on database permissions it can go further.
The vector is network based, needs no privileges and no user interaction, which is how it reaches 9.8. The record does not mark the CVE as exploited in the wild.
Quick check
Does a web application firewall solve this?
It can reduce risk while you plan the upgrade, but it is not a fix. Upgrading closes the flaw in the code.
Sources
- USOM notice TR-26-1063 (listed in the CVE record; the page needs JavaScript and could not be read when this post was reviewed)
- Gold entry for CVE-2026-9163
Last reviewed: 19 October 2026.
