| शीर्षक | onetwothreeneth HospitalManagementSystem 9ef91ed6007314b6473110ed699dff76d158f61d SQL Injection |
|---|
| विवरण | Affected: `php/controller.php` lines 388-397. The GET parameter `transaction_idS` is echoed and then concatenated unsanitized into an update statement: `echo $transaction_id = $_GET['transaction_idS']; ... udi("$u transactions set status='0' where transaction_id='$transaction_id'")`. `filters()` (used elsewhere) is not applied to GET input. The file is reachable unauthenticated (no session check; included by `login.php` and every admin page). Exploitation: time-based blind SQL injection (`?transaction_idS=8' AND SLEEP(3)-- -`) confirms the injection in an UPDATE query; `?transaction_idS=999' OR 1=1-- -` archives (sets status='0') **every** transaction in the database. Combined with blind extraction the whole database can be read; mass data tampering/DoS is demonstrated. |
|---|
| स्रोत | ⚠️ https://github.com/onetwothreeneth/HospitalManagementSystem/issues/8 |
|---|
| उपयोगकर्ता | Cevz68 (UID 101220) |
|---|
| सबमिशन | 14/09/2026 04:53 PM (21 दिन पहले) |
|---|
| संयम | 05/10/2026 12:15 PM (21 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 413577 [onetwothreeneth HospitalManagementSystem तक 9ef91ed6007314b6473110ed699dff76d158f61d php/controller.php transaction_idS SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|