Patient Record Management System SQL Injection Vulnerability in birthing_record.php

A critical SQL injection vulnerability has been identified in the Patient Record Management System version 1.0. The issue arises in the file birthing_record.php, where the itr_no parameter can be manipulated to execute arbitrary SQL commands. This vulnerability can be exploited remotely, potentially allowing attackers to access sensitive information from the application's database.

Impact

Exploitation of this vulnerability allows for unrestricted SQL injection, where an attacker can execute arbitrary SQL commands. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a GET request to birthing_record.php with a crafted itr_no parameter. The parameter value should be chosen to manipulate the SQL query execution, taking advantage of the application's SQL injection vulnerability.