Time-based Blind SQLi in PRMS Login Portal (Patient Record Management System)

Key Information Summary Vulnerability Overview Vulnerability Type: Time-based Blind SQL Injection Affected System: Patient Record Management System (PRMS) Login Portal Discoverer: Subhash Poudel Date: June 29, 2020 Source Code Link: GitHub Repository Target URL: http://localhost/PRMS/php/login.php Technology Stack: Apache 2.4.38, PHP 8.0.30, MySQL 5.0.12 Vulnerability Details Affected Parameter: username HTTP Method: POST Endpoint URL: http://localhost/PRMS/php/login.php Automated Exploitation (SQLMap) Injection Type: Time-based Blind Database: MySQL (MariaDB) Injection Confirmed: Yes Example Payload: admin' AND (SELECT 6666 FROM (SELECT(SLEEP(5)))yqSN) AND 'mle='='mle&password=admin Manual Exploitation Steps 1. Intercept Request: Capture the login request using Burp Suite. 2. Modify Payload: Change the payload in Burp Repeater. 3. Send and Observe: Send the modified request and observe the response. Security Risks Unauthorized Access: Bypass authentication to log in as any user, including admin. Data Leakage: Exposure of sensitive records, passwords, or medical data. System Compromise: Alter or delete records, inject malicious code, or achieve RCE (Remote Code Execution). Regulatory Non-Compliance: Potential violation of HIPAA, GDPR, or other data protection laws. Mitigation & Recommendations Input Validation: Use parameterized queries or prepared statements. WAF: Deploy a Web Application Firewall to block SQL injection patterns. Least Privilege: Restrict database user privileges; avoid using root accounts. Logging: Log all failed login attempts and suspicious payloads. Secure Error Handling: Disable detailed error messages to prevent aiding attackers. Code Review: Conduct manual code review and static analysis to ensure proper handling of user input. Conclusion This SQL injection vulnerability is highly exploitable and extremely dangerous, potentially leading to full database disclosure. Immediate remediation without delay is strongly recommended.

Goal Reached Thanks to every supporter — we hit 100%!

Time-based Blind SQLi in PRMS Login Portal (Patient Record Management System)

More from this source