CVE-2021-44095
📋 TL;DR
CVE-2021-44095 is a critical SQL injection vulnerability in ProjectWorlds Hospital Management System in PHP 1.0 that allows remote attackers to execute arbitrary SQL commands on the login page. This can lead to complete compromise of the application database, including data theft, modification, or deletion. Any organization using this specific software version is affected.
💻 Affected Systems
- ProjectWorlds Hospital Management System in PHP
📦 What is this software?
Hospital Management System by Hospital Management System Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, data destruction, privilege escalation to admin access, and potential lateral movement to other systems.
Likely Case
Unauthorized access to sensitive patient and hospital data, including medical records, personal information, and administrative credentials.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection, though other vulnerabilities may still exist.
🎯 Exploit Status
Exploitation requires no authentication and can be performed with simple SQL injection payloads. Public proof-of-concept code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
1. Review the GitHub repository for any updates or patches. 2. Manually implement parameterized queries in login.php. 3. Replace raw SQL queries with prepared statements using PDO or mysqli. 4. Implement proper input validation and sanitization.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection protection rules to block malicious payloads before they reach the application.
Input Validation Filter
allImplement server-side input validation to reject SQL injection patterns in login fields.
Add to login.php: if(preg_match('/[\'\"\;\-\-\/\*\=]/', $_POST['username'])) { die('Invalid input'); }
🧯 If You Can't Patch
- Isolate the system behind a firewall with strict access controls and monitor all database queries.
- Implement database monitoring and alerting for unusual SQL patterns or unauthorized access attempts.
🔍 How to Verify
Check if Vulnerable:
Test the login page with SQL injection payloads like: ' OR '1'='1 in username field. If login succeeds without valid credentials, system is vulnerable.Check Version:
Check the software version in the application interface or review the source code for version indicators.Verify Fix Applied:
Attempt the same SQL injection payloads after implementing fixes. Login should fail with invalid credentials and no database errors should be exposed.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts with SQL patterns
- Successful logins from unusual IP addresses
Network Indicators:
- HTTP POST requests to login.php containing SQL keywords
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND uri="/login.php" AND (request CONTAINS "' OR" OR request CONTAINS "'--" OR request CONTAINS "UNION")🔗 References
- https://github.com/projectworldsofficial/hospital-management-system-in-php
- https://github.com/projectworldsofficial/hospital-management-system-in-php/issues/1
- https://medium.com/%40shubhamvpandey/cve-2021-44095-481059d14470
- https://github.com/projectworldsofficial/hospital-management-system-in-php
- https://github.com/projectworldsofficial/hospital-management-system-in-php/issues/1
- https://medium.com/%40shubhamvpandey/cve-2021-44095-481059d14470
