PT-2022-19081 · Sourcecodester · Sourcecodester Doctors Appointment System

B3Nj1 · Published 2022-05-04 · Updated 2022-05-12 · CVE-2022-28568

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Doctor's Appointment System version 1.0

Description The issue allows for remote command execution through file upload, specifically via image upload from the administrator panel. An attacker can exploit this by knowing the path where the images are stored.

Recommendations For Sourcecodester Doctor's Appointment System version 1.0, consider restricting access to the image upload feature in the administrator panel until a fix is available. As a temporary workaround, restrict write access to the directory where uploaded images are stored to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-28568

Affected Products

Sourcecodester Doctors Appointment System

References · 5

• 🔥 https://github.com/b3nj1-1/CVE/tree/main/CVE-2022-28568 · Exploit
• https://osv.dev/vulnerability/CVE-2022-28568 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28568 · Security Note
• http://doctors.com · Note
• http://sourcecodetester.com · Note