{"id":"CVE-2026-112172","kind":"vulnerability","aliases":["CVE-2026-112172"],"related":[],"title":"CGM XDent and XMedical: unauthenticated SQL injection via sync endpoints","description":"CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session variables and execute arbitrary SQL queries against backend MySQL databases.","summary":"CGM XDent and XMedical expose PHP synchronization endpoints that accept requests without login. An attacker can change session variables and run arbitrary SQL queries against the backend MySQL database.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CGM XDent and XMedical","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"CGM XDent","fixed":[],"affected":"< 4.4.0 (NVD); 4.4.0 (CSIRT Italia) - sources disagree","ecosystem":"vendor"},{"name":"CGM XMedical","fixed":[],"affected":"< 4.4.0 (NVD); 4.4.0 (CSIRT Italia) - sources disagree","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cgm-xdent","cgm-xmedical","healthcare","mysql","php","sql-injection","vendor"],"not_affected_if":[],"how_to_check":"No local file or version proves the fix, since the flaw is in a central synchronization service. Ask CGM which XDent/XMedical version and sync service you use and whether the fix is applied. Confirm the sync endpoints reject unauthenticated requests and check that the database is not reachable from outside. Review logs from before the fix for unusual access. Do not scan the vendor's servers without authorization (ApoCert).","fix":"No fixed version published. CGM Italia says fixes were distributed automatically to affected installations; confirm with CGM customer service that your install and the sync service are updated.","status":"open","published_at":"2026-11-09T12:16:35+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","triaged_at":"2026-11-09T12:27:17+00:00","updated_at":"2026-11-09T12:31:29+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-09T12:27:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"CGM XDent and XMedical: unauthenticated SQL injection via sync endpoints","impact":"high","summary":"CGM XDent and XMedical expose PHP synchronization endpoints that accept requests without login. An attacker can change session variables and run arbitrary SQL queries against the backend MySQL database.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["cgm-xdent","cgm-xmedical","php","mysql"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker reads or alters backend MySQL database contents","analyst_note":"Find the vendor advisory or NVD CPE data for affected CGM XDent and XMedical versions, fixed builds, and check steps.","how_to_check":"- unknown","plain_action":"","product_name":"CGM XDent and XMedical","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000653,"input_tokens":4524,"output_tokens":402,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory or NVD CPE data for affected CGM XDent and XMedical versions, fixed builds, and check steps.","search":"'-112172':13A,16A '-2026':12A,15A 'accept':47B 'allow':76C 'and':19A 'arbitrari':59B,85C 'attack':52B,78C 'backend':64B,89C 'cgm':1A,17A,21A,23A,26B,29B,38B,67C 'cgm-xdent':25B 'cgm-xmedic':28B 'chang':54B 'cve':11A,14A 'databas':66B,91C 'endpoint':10A,45B,74C 'execut':84C 'expos':42B,71C 'healthcar':31B 'inject':7A,36B 'login':50B 'manipul':80C 'mysql':32B,65B,90C 'php':33B,43B,72C 'queri':61B,87C 'request':48B 'run':58B 'session':55B,81C 'sql':6A,35B,60B,86C 'sql-inject':34B 'sync':9A 'synchron':44B,73C 'unauthent':5A,77C 'variabl':56B,82C 'vendor':37B 'via':8A 'without':49B 'xdent':2A,18A,22A,27B,39B,68C 'xmedic':4A,30B,41B,70C 'xmedical':20A,24A","nicknames":[],"mitigations":[],"who_affected":"Dental and medical practices running CompuGroup Medical XDent or XMedical with its synchronization service. NVD says versions before 4.4.0 are affected; the Italian CSIRT lists 4.4.0, so check your version with CGM. Anyone not using the sync feature or these products can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["cgmxdent","cgmxdentandxmedical","cgmxmedical","xdent","xdentandxmedical","xmedical"],"ptokens":["and","cgm","xdent","xmedical"],"labels":["cgmxdent","cgmxmedical","healthcare","high","mysql","php","sqlinjection","vendor"],"campaign_type":null,"search_a":"'-112172':13A,16A '-2026':12A,15A 'and':19A 'cgm':1A,17A,21A,23A 'cve':11A,14A 'endpoint':10A 'inject':7A 'sql':6A 'sync':9A 'unauthent':5A 'via':8A 'xdent':2A,18A,22A 'xmedic':4A 'xmedical':20A,24A","search_b":"'accept':47B 'arbitrari':59B 'attack':52B 'backend':64B 'cgm':26B,29B,38B 'cgm-xdent':25B 'cgm-xmedic':28B 'chang':54B 'databas':66B 'endpoint':45B 'expos':42B 'healthcar':31B 'inject':36B 'login':50B 'mysql':32B,65B 'php':33B,43B 'queri':61B 'request':48B 'run':58B 'session':55B 'sql':35B,60B 'sql-inject':34B 'synchron':44B 'variabl':56B 'vendor':37B 'without':49B 'xdent':27B,39B 'xmedic':30B,41B","search_c":"'allow':76C 'arbitrari':85C 'attack':78C 'backend':89C 'cgm':67C 'databas':91C 'endpoint':74C 'execut':84C 'expos':71C 'manipul':80C 'mysql':90C 'php':72C 'queri':87C 'session':81C 'sql':86C 'synchron':73C 'unauthent':77C 'variabl':82C 'xdent':68C 'xmedic':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T12:16:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112172","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112172","severity":null,"published_at":"2026-11-09T12:16:35+00:00","modified_at":"2026-11-09T12:16:35+00:00","first_seen_at":"2026-11-09T12:26:23+00:00","fetched_at":"2026-11-09T12:26:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112172:2288","url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","severity":null,"published_at":"2026-11-09T12:31:29+00:00","modified_at":"2026-11-09T12:31:29+00:00","first_seen_at":"2026-11-09T12:31:29+00:00","fetched_at":"2026-11-09T12:31:29+00:00","note":"NVD lists XDent/XMedical <4.4.0 (no CPE); CSIRT Italia (ACN) lists 4.4.0 as affected - the two disagree, unresolved. No fixed version named anywhere. CGM Italia says fixes were distributed automatically (its page doesn't name XDent/XMedical); ApoCert says the vendor declared it resolved and the sync service is central, so the local version doesn't prove the fix. No exploitation or PoC found. Exa credits exhausted; ACN's CVE-to-product mapping is not explicit, and ApoCert ties it to this CVE. Nothing verified: no vendor advisory read.","cites":["https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html","https://www.apocert.it/pubblicazioni/xdent-xmedical-avviso-sicurezza-sincronizzazione"]}],"documents":[{"id":107407,"url":"https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical","title":"CSIRT Italia: vulnerabilità in prodotti CompuGroup Medical","kind":"advisory","source":"analyst","publisher":null,"text":"ACN (Italy) bulletin listing 16 CVEs incl. CVE-2026-118462. Affected: XDent 4.4.0, XMedical 4.4.0, Wingesfar <2026.07a, Venere <=8.33.2, Phronesis <=4.51.0.1, Infantia <=6.09.1, Profim <=6.09.1. No fixed versions listed; update via support channels agreed with CGM. No PoC or exploitation reported.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":107410,"url":"https://www.cgm.com/ita_it/magazine/articles/comunicati-stampa/piu-sicurezza-per-farmacie-studi-medici-e-pazienti-cgm-italia-risolve-potenziali-vulnerabilita-software-insieme-a-csirt-italia.html","title":"CGM Italia: fixes distributed automatically, with CSIRT Italia","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":107424,"url":"https://www.apocert.it/pubblicazioni/xdent-xmedical-avviso-sicurezza-sincronizzazione","title":"ApoCert: XDent/XMedical sync security notice","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}