| शीर्षक | onetwothreeneth HospitalManagementSystem 9ef91ed6007314b6473110ed699dff76d158f61d SQL Injection |
|---|
| विवरण | Affected: `patient_info.php` lines 15-18 and 54-66. `$_GET['patient_id']` is concatenated unsanitized into multiple SELECT statements: `fetch("$s transactions where status='1' and patient_id='$patient_id' ...")`, `counts("$s patients where ... patient_id='$patient_id'")` and the `get("img","$s patients where patient_id='$patient_id'")` / `get("name",... )` calls that reflect column values into the page. It is reachable unauthenticated (session guard does not exit). Exploitation: boolean differential (`13' AND '1'='1` shows transactions, `13' AND '1'='2` shows none) and UNION-based exfiltration - a UNION SELECT against the `patients` shape prints the admin password into the `<h3 class="meta-heading">` element (`666' UNION SELECT 1,(SELECT pass FROM users WHERE user_id=1),3,4,5,6,7,8,9,10,11-- -`), fully demonstrating unauthenticated data theft. |
|---|
| स्रोत | ⚠️ https://github.com/onetwothreeneth/HospitalManagementSystem/issues/9 |
|---|
| उपयोगकर्ता | Cevz68 (UID 101220) |
|---|
| सबमिशन | 14/09/2026 04:53 PM (22 दिन पहले) |
|---|
| संयम | 05/10/2026 12:15 PM (21 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 413578 [UNION HospitalManagementSystem तक 9ef91ed6007314b6473110ed699dff76d158f61d patient_info.php patient_id SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|