Campcodes Hospital Management System SQL Injection Vulnerability in Registration.php

A critical SQL injection vulnerability has been identified in Campcodes Hospital Management System version 1.0. The issue resides in the registration.php file, where the full_name or username parameter can be manipulated to execute unauthorized SQL commands. This vulnerability can be exploited remotely, without any authentication.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

The vulnerability can be reproduced by sending a POST request to the registration.php file with the full_name parameter crafted to include SQL injection payloads. This can be done manually or using automated tools like sqlmap, which can exploit the vulnerability by injecting SQL commands that, for example, cause a delay in the response, indicating successful exploitation.