Online Diagnostic Lab Management System version 1.0 suffers from a remote SQL injection vulnerability.
#Exploit Title: Online Diagnostic Lab Management System 1.0 - SQL Injection (Unauthenticated)
#Exploit Author: Himash
#Vendor Homepage: https://www.sourcecodester.com/php/15129/online-diagnostic-lab-management-system-php-free-source-code.html
#Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/odlms.zip
#Tested on: Kali Linux 2021.4, PHP 7.2.34
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database.
Online Diagnostic Lab Management System 1.0 is vulnerable to the SQL Injection in 'id' parameter of the 'appointment list' page.
#Steps to reproduce
Following URL is vulnerable to SQL Injection in the 'id' field.
Server accepts the payload and the response get delayed by 7 seconds.
An attcker can compromise the database of the application by manual method or by automated tools such as SQLmap.