| عنوان | Clinic's Patient Management System 2.0 Unrestricted file upload (RCE) |
|---|
| الوصف | Clinic's Patient Management System is vulnerable to unrestricted file upload. At the file upload function, the application system checks the validity of the file type, format, and content uploaded by the user, so that attackers can upload Webshell (.php, .jsp, asp, etc.) malicious script files or files in unexpected formats, such as HTML files, SHTML files, etc., at the same time, you can use characters such as directory jump or control the upload directory to directly upload files to the Web directory or any directory, which lead to the execution of arbitrary malicious script files on the remote server, thereby directly obtaining application system permissions. |
|---|
| المصدر | ⚠️ https://github.com/CyberThoth/CVE/blob/8c6b66919be1bd66a54c16cc27cbdd9793221d3e/CVE/Clinic's%20Patient%20Management%20System/Unrestricted%20file%20upload%20(RCE)/POC.md |
|---|
| المستخدم | cyberthoth (UID 28322) |
|---|
| ارسال | 04/07/2022 03:25 AM (4 سنوات منذ) |
|---|
| الاعتدال | 04/07/2022 07:07 AM (4 hours later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 203178 [SourceCodester Clinics Patient Management System 2.0 update_user.php?user_id=1 profile_picture تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|