RCE via Arbitrary File Upload in Clinic's Patient Management System 1.0

This repository contains a Python exploit script (CVE-2022-40471.py) and a README.md for CVE-2022-40471, an authenticated remote code execution vulnerability in Clinic's Patient Management System (CPMS). The exploit authenticates to the CPMS web interface using provided credentials, then abuses the profile image upload functionality to upload a PHP web shell. The shell allows arbitrary command execution via the 'cmd' GET parameter. The script is operational and provides a working payload, but requires valid credentials. The README provides background, exploitation steps, and usage instructions. The main endpoints targeted are the login page, the file upload handler (users.php), and the directory where uploaded images (and the shell) are stored. The exploit is not part of a framework and is a standalone Python script.

This repository contains a single Metasploit module (clinic_pms_fileupload_rce.rb) that exploits an unauthenticated file upload vulnerability in Clinic's Patient Management System 1.0 (CVE-2022-40471). The exploit works by uploading a PHP web shell via the /pms/users.php endpoint and then accessing it through the /pms/user_images/ directory, which must have directory listing enabled. The module checks for vulnerability by uploading a dummy file and verifying its presence in the directory listing. If successful, it uploads a PHP payload (web shell) and executes it, granting remote code execution on the target server. The exploit is fully weaponized, leveraging Metasploit's payload generation and file cleanup features. The only file in the repository is the Metasploit module itself, written in Ruby.

This repository contains a Python exploit script (CVE-2022-40471.py) and a README.md for CVE-2022-40471, a remote code execution vulnerability in Clinic's Patient Management System v1.0. The exploit targets an unrestricted file upload flaw in the 'users.php' page, allowing an authenticated attacker to upload a PHP webshell as a profile picture. The script first authenticates to the application using provided credentials, then uploads a PHP shell via a crafted multipart/form-data POST request. Upon success, the shell is accessible in the 'user_images' directory, enabling arbitrary command execution via HTTP requests. The README provides technical details, usage instructions, and mitigation advice. The exploit is a proof-of-concept and requires valid credentials and network access to the target web application.