Hospital Management System Project In ASP.Net MVC 1 SQL Injection

`# Exploit Title: Hospital Management System Project in ASP.Net MVC - SQL  
Injection / Authentication Bypass  
# Date: 07/16/2024  
# Exploit Author: 0xMykull  
# Vendor Hompage:  
https://itsourcecode.com/free-projects/asp/hospital-management-system-project-in-asp-net-mvc-with-source-code/  
# Software Link:  
https://itsourcecode.com/free-projects/asp/hospital-management-system-project-in-asp-net-mvc-with-source-code/  
# Version: 1  
# CVE: CVE-2024-40502  
  
Description:  
An SQL injection vulnerability has been discovered in the btn_login_b_Click  
function of the affected web application. The vulnerability exists due to  
the improper sanitization of user-supplied input in the login form.  
Specifically, the txt_login_username.Text and txt_login_pass.Text fields  
are concatenated directly into an SQL query string without proper  
parameterization or escaping.  
  
Endpoint: https://localhost:44306/Users/Loginpage.aspx  
  
Bypass Payloads:  
  
(default user)  
Username: kihsan'--  
password: <anything>  
  
Username: <anyvaliduser>'--  
password: <anything>  
`