PT-2022-15750 · Sourcecodester · Sourcecodester Clinics Patient Management System

Cyberthoth · Published 2022-07-12 · Updated 2024-09-07 · CVE-2022-2297

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Clinics Patient Management System version 2.0

Description A critical issue was found in the system, affecting an unknown function of the file /pms/update user.php?user id=1. The manipulation of the profile picture argument with malicious input, such as , leads to unrestricted upload. This issue can be exploited remotely. The exploit has been publicly disclosed.

Recommendations For SourceCodester Clinics Patient Management System version 2.0, consider restricting access to the /pms/update user.php file until a patch is available. As a temporary workaround, avoid using the profile picture argument in the affected API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-2297

Affected Products

Sourcecodester Clinics Patient Management System

References · 6

• 🔥 https://github.com/CyberThoth/CVE/blob/8c6b66919be1bd66a54c16cc27cbdd9793221d3e/CVE/Clinic%27s%20Patient%20Management%20System/Unrestricted%20file%20upload%20%28RCE%29/POC.md · Exploit
• 🔥 https://vuldb.com/?id.203178 · Exploit
• 🔥 https://github.com/CyberThoth/CVE/blob/8c6b66919be1bd66a54c16cc27cbdd9793221d3e/CVE/Clinic\'s%20Patient%20Management%20System/Unrestricted%20file%20upload%20(RCE)/POC.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-2297 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2297 · Vendor Advisory
• https://t.me/cibsecurity/46073 · Telegram Post