| शीर्षक | itsourcecode Hospital Management System 1.0 SQL Injection |
|---|
| विवरण | Description:
The patient login concatenates both `loginid` and `password` directly into SQL without sanitization. Both fields are independently injectable. Passwords stored in plaintext.
Vulnerable Code:
**File**: `patientlogin.php`, Line 12
```php
$query = "SELECT * FROM patient WHERE loginid='".$_POST['loginid']."' AND password='".$_POST['password']."'";
$result = mysqli_query($con, $query);
```
Plaintext password comparison, no escaping.
Impact:
- Patient account takeover
- Access to all patient medical records, treatment history
- Plaintext credential exposure via UNION injection
Reference: https://github.com/microwaveabi/vul/issues/69 |
|---|
| स्रोत | ⚠️ https://github.com/microwaveabi/vul/issues/69 |
|---|
| उपयोगकर्ता | microwave (UID 96185) |
|---|
| सबमिशन | 11/07/2026 05:18 AM (3 महीनों पहले) |
|---|
| संयम | 26/08/2026 06:44 PM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 376306 [itsourcecode Hospital Management System 1.0 /patientlogin.php loginid SQL इंजेक्शन] |
|---|
| अंक | 0 |
|---|