| शीर्षक | onetwothreeneth HospitalManagementSystem 9ef91ed6007314b6473110ed699dff76d158f61d Unrestricted Upload |
|---|
| विवरण | Affected: `php/controller.php` upload handlers `add_patient` (lines 66-69), `add_physician` (119-122), `add_account` (207-211), `update_account` (183-198), `update_subaccount` (238-255), `edit_physician` (285-300), `edit_patient` (318-333). The file name is stored and moved without any check: `$img = $_FILES['img']['name']; $target_file = $target_dir.basename($_FILES["img"]["name"]); move_uploaded_file($_FILES["img"]["tmp_name"], $target_file);`. Because `php/sessions.php` redirects without terminating execution, the handlers are reachable without authentication, so an unauthenticated attacker uploads an arbitrary `.php` file into the web-accessible `img/` directory and executes it: remote code execution, disclosure of the whole database (including plaintext credentials) and complete compromise of the server. |
|---|
| स्रोत | ⚠️ https://github.com/onetwothreeneth/HospitalManagementSystem/issues/5 |
|---|
| उपयोगकर्ता | wy17634604398_gmail.com (UID 101056) |
|---|
| सबमिशन | 07/09/2026 07:47 PM (25 दिन पहले) |
|---|
| संयम | 02/10/2026 06:24 AM (24 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 412925 [onetwothreeneth HospitalManagementSystem तक 9ef91ed6007314b6473110ed699dff76d158f61d php/controller.php img अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|