search

opensource-emr / hospital-management-emr

A complete open source for electronic healthcare record management in Hospitals, Clinics and Pharmacy.
https://opensource-emr.github.io/hospital-management-emr/
MIT License
255 stars 176 forks source link

Login form may be vulnerable to SQL injection #83

Closed WiadroMasla closed 7 months ago

WiadroMasla commented 7 months ago

Enviroment: Windows 10, Opera GX

Steps to reproduce:

  1. Login using following credentials Username: admin Password: 1' or 1=1 -- -

Expected result: "Invalid credentials" message

Actual result: Connection error ERR_CONNECTION_RESET

This may indicate that code has been injected successfully but the rest of the function didn't yield the result. Creating a successful SQL injection may be possible, especially considering that database scheme with all functions is open source.

opensource-emr commented 7 months ago

ERR connection reset is not a sign of SQL injection. If you see the code we are using LINQ and its not dynamic also. LINQ to SQL passes all data to the database via SQL parameters. So, although the SQL query is composed dynamically, the values are substituted server side through parameters safeguarding against the most common cause of SQL injection attacks.