SQL Injection Vulnerability in HospitalManagementSystem (edit_accounts/patient.php)

Vulnerability Overview In the HospitalManagementSystem project, SQL injection vulnerabilities exist in the auto-fill queries of all record editing pages ( , , , , ). These pages construct pre-filled editing forms using the parameter and incorporate these parameters into SQL clauses, leading to SQL injection risks. Scope of Impact Affected Versions: Commit 9e931d0600731d8d47311b0e699df76d158f61d (latest) Vulnerability Type: CWE-89: SQL Injection (time-based blind) Affected Code: - (lines 12-13) - (line 12) - ( ) - ( ) - ( , lines 17/23/30/42/43) Remediation Root Cause: inputs are directly embedded into SQL queries without escaping or the use of prepared statements. Furthermore, these pages lack effective authentication mechanisms. Remediation Recommendations: - Properly escape all inputs or utilize prepared statements. - Implement effective authentication mechanisms to ensure that only authorized users can access these pages. Proof of Concept (POC) Code CVSS 3.1 Score Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Score: 7.5 Severity: High (High: 7.0-8.9 / Critical: 9.0-10.0 / Medium: 4.0-6.9 / Low: 0.3-3.9) Calculation Tool: NVD CVSS Calculator Impact An unauthenticated attacker can blind-extract the entire database through any of the five endpoints, including patient/doctor records, financial transactions, and plaintext account passwords. Reproduction Steps 1. The time-based differential ( ) is evaluated for each query on each endpoint. 2. Test the SQL injection vulnerability on each endpoint using commands. Reproduction Screenshots !Reproduction Screenshots Summary This vulnerability allows unauthenticated attackers to extract sensitive data via SQL injection, including patient/doctor records, financial transactions, and plaintext account passwords. It is recommended to remediate this vulnerability as soon as possible to prevent potential data breaches.

Goal Reached Thanks to every supporter — we hit 100%!

SQL Injection Vulnerability in HospitalManagementSystem (edit_accounts/patient.php)

More from this source