CVEvulnerability

CVE-2022-28568

9.8 CRITICAL Published 2022-05-04 Modified 2026-07-09 Official page ↗
Status
Modified
Published
2022-05-04
Last modified
2026-07-09
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-434

Description

Sourcecodester Doctor's Appointment System 1.0 is vulnerable to File Upload to RCE via Image upload from the administrator panel. An attacker can obtain remote command execution just by knowing the path where the images are stored.

Affected configurations

• simple doctor\'s appointment system project simple doctor\'s appointment system 1.0

Related

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References