CVE-2024-10350
📋 TL;DR
This critical SQL injection vulnerability in Hospital Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the docname parameter in /admin/add-doctor.php. This affects all systems running the vulnerable version of this software, potentially compromising patient data and system integrity.
💻 Affected Systems
- code-projects Hospital Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to patient data theft, system takeover, and potential ransomware deployment across the hospital network.
Likely Case
Unauthorized access to sensitive patient records, modification of medical data, and potential privilege escalation to administrative accounts.
If Mitigated
Limited data exposure if proper input validation and database permissions are enforced, though SQL injection attempts would still be logged.
🎯 Exploit Status
Exploit details are publicly disclosed on GitHub. Attack requires access to admin interface but SQL injection is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://code-projects.org/
Restart Required: No
Instructions:
No official patch available. Consider migrating to alternative hospital management software or implementing custom security fixes.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd parameterized queries or prepared statements to /admin/add-doctor.php to prevent SQL injection
Modify PHP code to use PDO or mysqli prepared statements for all database queries involving docname parameter
Web Application Firewall Rules
allBlock SQL injection patterns targeting the vulnerable endpoint
Add WAF rule: deny requests to /admin/add-doctor.php containing SQL keywords like UNION, SELECT, INSERT, DROP, OR 1=1
🧯 If You Can't Patch
- Isolate the Hospital Management System behind a reverse proxy with strict input validation
- Implement network segmentation to limit database access from the web application server
🔍 How to Verify
Check if Vulnerable:
Test the /admin/add-doctor.php endpoint with SQL injection payloads in the docname parameter (e.g., docname=test' OR '1'='1)Check Version:
Check the software version in the application interface or review the installation files for version markersVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return appropriate error messages or are blocked📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts to admin panel followed by SQL error messages
- Unusual database queries originating from web server IP
Network Indicators:
- HTTP POST requests to /admin/add-doctor.php containing SQL keywords in parameters
- Abnormal database connection patterns from web application
SIEM Query:
source="web_logs" AND uri_path="/admin/add-doctor.php" AND (param="*UNION*" OR param="*SELECT*" OR param="*OR 1=1*")