Care2x 2.7 (his) hospital information system multiple sql injection Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2019-01-28 |
Type : webapps |
Platform : php
This exploit / vulnerability Care2x 2.7 (his) hospital information system multiple sql injection is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: Care2x 2.7 (HIS) Hospital Information system - Multiples SQL Injection
# Date: 01/17/2019
# Software Links/Project: https://github.com/care2x/care2x | http://www.care2x.org/
# Version: Care2x 2.7
# Exploit Author: Carlos Avila
# Category: webapps
# Tested on: Windows 8.1 / Ubuntu Linux
# Contact: http://twitter.com/badboy_nt
1. Description
Care2x is PHP based Hospital Information system, It features complete clinical flow management, laboratory management, patient records, multi-user support with permissions, stock management and accounting and billing management, PACS integration and DICOM viewer. Care2x provides some other features as CCTV integration which has not been seen in other open source HIS.
This allows unauthenticated remote attacker to execute arbitrary SQL commands and obtain private information. Admin or users valid credentials aren't required. In a deeper analysis other pages are also affected with the vulnerability over the same input.
It written in PHP version 5.x, it is vulnerable to SQL Injection. The parameter on cookie 'ck_config' is vulnerable on multiples URLS occurrences, explains to continue:
[14:18:15] [WARNING] changes made by tampering scripts are not included in shown payload content(s)
[14:18:15] [INFO] testing MySQL
[14:18:16] [INFO] confirming MySQL
[14:18:19] [INFO] the back-end DBMS is MySQL
[14:18:19] [INFO] actively fingerprinting MySQL
[14:18:20] [INFO] executing MySQL comment injection fingerprint
[14:18:33] [DEBUG] turning off reflection removal mechanism (for optimization purposes)
web server operating system: Linux Ubuntu
web application technology: Nginx 1.14.0
back-end DBMS: active fingerprint: MySQL >= 5.7
comment injection fingerprint: MySQL 5.7.24