vendor:
Clinic's Patient Management System
by:
Oğulcan Hami Gül
6.1
CVSS
HIGH
Unauthenticated Remote Code Execution (RCE)
78
CWE
Product Name: Clinic's Patient Management System
Affected Version From: 1
Affected Version To: 1
Patch Exists: NO
Related CWE:
CPE: a:clinic:patient_management_system:1.0
Platforms Tested: Windows 10
2023
Clinic’s Patient Management System 1.0 – Unauthenticated Remote Code Execution
Unauthenticated users can exploit the Clinic's Patient Management System version 1.0 by uploading a malicious PHP file in place of a profile picture via the /pms/users.php address. This allows attackers to execute arbitrary commands on the server without requiring any authentication.
Mitigation:
It is recommended to implement proper input validation and access controls to prevent unauthenticated users from uploading files. Regular security assessments and code reviews can help identify and mitigate such vulnerabilities.
