Hospital-management-system-in-php 378c157 - Blind SQL Injection

Description

Hospital management system version 378c157 allows to bypass authentication. This is possible because the application is vulnerable to SQLI.

Vulnerability

A sql injection (SQLI) vulnerability has been identified in Hospital management system. This allows bypassing authentication and access as any user, in this case administrator.

Exploit

POST /hospital/hms-staff.php HTTP/1.1
Host: vulnerable.com
Content-Length: 43
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*

Evidence of exploitation

Our security policy

We have reserved the ID CVE-2023-5004 to refer to this issue from now on. Disclosure policy

System Information

• Version: hospital-management-system-in-php 378c157

• Operating System: GNU/Linux

Mitigation

There is currently no patch available for this vulnerability.

References

• Vendor page https://github.com/projectworldsofficial/hospital-management-system-in-php/