提出 #906739: code-projects Hospital Information System 1.0 SQL Injection

The Hospital Information System in PHP is potentially vulnerable to SQL injection in the login functionality implemented by UsersController.php.

The endpoint accepts authentication information through an HTTP POST request containing type, email, and password parameters. The type=login value instructs the controller to process the request as an authentication attempt.

The email parameter appears to be used as part of a backend database query responsible for locating and validating a user account.

The supplied proof-of-concept request contains the following email value:

[email protected]' or '7743'='7743
The quotation mark may terminate the intended SQL string context, while the appended expression:

or '7743'='7743
introduces an always-true boolean condition.

If the application constructs its login SQL query by directly concatenating the email parameter, attacker-controlled SQL syntax may become part of the database statement instead of being treated exclusively as data.

A vulnerable authentication pattern may conceptually resemble:

$email = $_POST['email'];
$password = $_POST['password'];

$sql = "SELECT * FROM users
WHERE email = '$email'
AND password = '$password'";

$result = $pdo->query($sql);
In such an implementation, untrusted input can alter the intended SQL syntax.

Depending on operator precedence and the precise query structure, a boolean condition may produce a different result from a normal invalid authentication attempt. If this behavior is reproducible, it provides evidence that attacker-controlled input is influencing database query execution.

If arbitrary SQL injection is confirmed, an unauthenticated attacker may potentially access sensitive database information, enumerate user or administrator accounts, obtain authentication-related records, or manipulate database data where sufficient database privileges exist.

The Hospital Information System manages administrative functions, medicines, patient records, diagnoses, treatment-related information, and appointments, making confidentiality of its backend database particularly important.

Because the affected functionality is a login endpoint, no pre-existing authenticated session is expected to be required.

• ソース: ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/SQL%20Injection%20in%20Hospital%20Information%20System%20%60email%60%20Parameter.md
• ユーザー: AhmadMarzouk (UID 95993)
• 送信: 2026年07月27日 20:09 (1 月 ago)
• モデレーション: 2026年09月06日 18:34 (1 month later)
• ステータス: 重複
• VulDBエントリ: 393038 [code-projects Hospital Information System 1.0 User Login UsersController.php User::login email SQLインジェクション]
• ポイント: 0