SQL injection in manager ( Admin/mlogin.php ) and doctor ( Admin/dlogin.php ) login
Both the manager and doctor login endpoints concatenate the submitted username and password into SQL queries. An attacker can bypass authentication with a boolean SQL injection payload and obtain a privileged manager or doctor session without valid credentials.
Commit: f427b4757128ca253d33d0cc4e87bbb9c999a4d5
SQL Injection / Authentication Bypass
Files: Admin/mlogin.php , Admin/dlogin.php
The username and password are interpolated directly into the SQL query with no escaping or prepared statements.
Send an invalid manager login request and note there is no redirect.
Send the same request with a boolean injection payload.
Repeat the same attack against the doctor login.
An unauthenticated attacker can authenticate as a manager or doctor, reaching the privileged management and clinical interfaces, and can use the same injection primitive to read or alter database data.
Please evaluate and assign a CVSS v3.1 score for this vulnerability.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
