| शीर्षक | RemoteClinic V2.0 Boolean-Based Blind SQL Injection |
|---|
| विवरण | A SQL injection vulnerability was discovered in the "Remote Clinic System" project in "/staff/profile. php? Id=28". The backend code did not effectively filter the ID parameter entered by the user and directly concatenated it into the SQL query statement, allowing attackers to close single quotes and insert Boolean logic statements for blind injection
Impact
1. Data breach: Attackers can obtain sensitive information such as user passwords, personal identification information, financial data, etc. by injecting malicious SQL queries.
2. Data tampering: Attackers can modify data in the database, such as changing the permissions or status of user accounts, or inserting false information into the database.
3. Data deletion: Attackers can delete data from the database, which may result in data loss and affect the normal operation of the application.
4. Executing malicious code: In some cases, if the database supports stored procedures or dynamic SQL execution, attackers may be able to execute malicious code, which could lead to more serious security consequences, such as the server being completely controlled. |
|---|
| स्रोत | ⚠️ https://github.com/03hice-collab/CVE/issues/3 |
|---|
| उपयोगकर्ता | 03hice (UID 89185) |
|---|
| सबमिशन | 25/08/2025 01:34 PM (9 महीनों पहले) |
|---|
| संयम | 01/09/2025 02:54 PM (7 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 322117 [RemoteClinic 2.0 /staff/profile.php पहचान SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|