Liuchang310

**Name of the Vulnerable Software and Affected Versions** code-projects Hospital Information System version 1.0 **Description** A remote SQL injection is possible through the manipulation of the `Search` argument within the `findBySearch()` function located in the addReq.php file. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the addReq.php file or avoid using the `Search` argument within the `findBySearch()` function.

**Name of the Vulnerable Software and Affected Versions** code-projects Hospital Information System version 1.0 **Description** Remote SQL injection is possible through the manipulation of the `ID` argument within the `viewReq()` function of the `viewReq.php` file. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Restrict access to the `viewReq()` function in the `viewReq.php` file until a fix is applied.

**Name of the Vulnerable Software and Affected Versions** code-projects Hospital Information System version 1.0 **Description** A remote SQL injection is possible due to improper handling of the `ID` argument within the `getSinglePresp()` function located in the includes/presp/PrespController.php file. SQL injection is a technique where an attacker inserts malicious SQL code into a query, allowing them to manipulate the database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `getSinglePresp()` function in the includes/presp/PrespController.php file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** code-projects Doctor Appointment System version 1.0 **Description** A remote SQL injection exists in the `/patient/booking.php` endpoint. This issue occurs when the `doc id` argument is manipulated, allowing an attacker to interfere with the database queries. **Recommendations** Update code-projects Doctor Appointment System version 1.0 to a patched version. As a temporary workaround, restrict access to the `/patient/booking.php` endpoint or validate the `doc id` parameter to prevent malicious input.

**Name of the Vulnerable Software and Affected Versions** code-projects Doctor Appointment System version 1.0 **Description** A flaw in the processing of the '/contactus.php' endpoint allows for remote exploitation. Specifically, manipulating the `firstname` variable leads to SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `firstname` parameter in the '/contactus.php' endpoint until the issue is resolved.