Remote code execution via unrestricted file upload vulnerability in the Clinic's Patient Management System v 1.0
Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php
in following Source Code we can see that developer directly allows to upload any media files without restricting an a specific extenstion which means we can upload any extensions file there which is not okay for security reasons and using this functionality flaw, attacker could upload malicious webshell to gain access complete server with root privileges
Mitigations: Please Restrict other extenstions while uploading an image file for profile picture upload functionality and allow only .jpg .png extensions which are only image related
Vulnerable Page - users.php
// users.php
$status = move_uploaded_file(
$_FILES["profile_picture"]["tmp_name"],
'user_images/' . $targetFile
);
if ($status) {
try {
$con->beginTransaction();
$query = "INSERT INTO `users`(`display_name`,
`user_name`, `password`, `profile_picture`)
VALUES('$displayName', '$userName', '$encryptedPassword', '$targetFile');";
$stmtUser = $con->prepare($query);
$stmtUser->execute();
$con->commit();
$message = 'user registered successfully';
} catch (PDOException $ex) {
$con->rollback();
echo $ex->getTraceAsString();
echo $ex->getMessage();
exit;
}
} else {
$message = 'a problem occured in image uploading.';
}
header("location:congratulation.php?goto_page=users.php&message=$message");
exit;
}
# Upload a simple webshell to the target machine -
python3 CVE-2022-40471.py <target_ip> <target_port> <target_uri> <username> <password>
python CVE-2022-40471.py 127.0.0.1 80 /pms/ UserName Password
https://drive.google.com/file/d/1m-wTfOL5gY3huaSEM3YPSf98qIrkl-TW/view?usp=sharing
https://www.sourcecodester.com/php-clinics-patient-management-system-source-code
https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-cpms.zip
RashidKhan Pathan (iHexCoder), 9 September 2022. Twitter: @itRashid