Remote Code Execution Vulnerability in Clinic's Patient Management System by Clinic

CVE-2022-40471

What is CVE-2022-40471?

The vulnerability in Clinic's Patient Management System version 1.0 allows an attacker to execute arbitrary code remotely. This is achieved through a flaw in the profile picture upload feature located in users.php, which does not adequately validate file uploads. As a result, an attacker can upload a malicious PHP webshell, enabling them to execute unauthorized commands on the server. This highlights significant security risks for healthcare providers using this software, making it crucial for organizations to implement immediate mitigation measures.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2022-40471
Created by Rapid7

CVE-2022-40471
Created by RashidKhanPathan

CVE-2022-40471
Created by Dharan10

References