PT-2022-2744 · Unknown · Hospital Management System

Published 2022-02-15 · Updated 2023-11-14 · CVE-2022-24226

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hospital Management System version 4.0

Description The issue is related to a blind SQL injection vulnerability in the register function of the Hospital Management System, specifically via the func2.php file. This vulnerability can be exploited by a remote attacker to disclose protected information. The vulnerability is due to the lack of protection of the SQL query structure.

Recommendations For Hospital Management System version 4.0, consider disabling the register function in func2.php until a patch is available to prevent exploitation of the blind SQL injection vulnerability. Restrict access to the func2.php file to minimize the risk of information disclosure. Avoid using the register function until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2022-03259

CVE-2022-24226

Affected Products

Hospital Management System

References · 7

• 🔥 https://github.com/Nguyen-Trung-Kien/CVE · Exploit
• 🔥 https://github.com/Nguyen-Trung-Kien/CVE/blob/main/CVE-2022-24226/CVE-2022-24226.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24226 · Security Note
• https://bdu.fstec.ru/vul/2022-03259 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24226 · Vendor Advisory
• https://t.me/cvenotify/27204 · Telegram Post
• https://t.me/cibsecurity/37499 · Telegram Post