CVE-2022-43162

Online Diagnostic Lab Management System 1.0 has a SQL injection in the id parameter of /tests/view_test.php. An attacker who can reach that endpoint with the required privilege can manipulate the query to read, alter, or destroy database contents, which in a lab management app means patient and test records. The metrics list high privileges as a precondition, so this is an authenticated user abusing the parameter rather than an anonymous internet attack.

This is a small, purpose-built PHP application, the kind that shows up in narrow deployments rather than across the internet at scale, so it doesn't attract the botnet-scanning attention that a popular CMS does. The privilege requirement further narrows the realistic attacker to someone who already has an account. The sensitivity of the data it holds is the reason to care despite the modest exploitation tempo.

Given the niche footprint, our first move is simply establishing whether we run this application anywhere at all, and if so whether it is internet-reachable. For a bespoke app like this, the highest-leverage control is often removing external exposure and putting parameterized-query enforcement or a WAF rule in front of view_test.php, since a v1.0 project may not see timely upstream fixes.