PT-2024-11616 · Unknown · Doctor-Appointment

Published 2024-12-09 · Updated 2025-05-17 · CVE-2022-38946

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Doctor-Appointment version 1.0

Description The issue allows attackers to execute arbitrary code due to an arbitrary file upload vulnerability in the /Frontend/signup com.php endpoint. This vulnerability enables attackers to upload malicious files, potentially leading to code execution.

Recommendations For Doctor-Appointment version 1.0, consider disabling the file upload functionality in the /Frontend/signup com.php endpoint until a patch is available. Restrict access to this endpoint to minimize the risk of exploitation. Avoid using this endpoint for file uploads until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-38946

Affected Products

Doctor-Appointment

References · 7

• 🔥 https://github.com/Cosemz/CVE/blob/main/Doctor-Appointment.md · Exploit
• https://osv.dev/vulnerability/CVE-2022-38946 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38946 · Security Note
• https://twitter.com/CVEnew/status/1866432950989955142 · Twitter Post
• https://t.me/cvenotify/103577 · Telegram Post
• https://t.me/cvedetector/12419 · Telegram Post
• https://t.me/cvenotify/122710 · Telegram Post