CVE-2022-28568
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
In Sourcecodester Doctor's Appointment System 1.0, a vulnerability allows remote code execution (RCE) via malicious file upload as an image from the admin panel. An attacker can gain full server control just by knowing the path where images are stored.
Risk Assessment
The risk for the organization includes full server compromise, theft of patient data, and potential further attacks on IT infrastructure. The vulnerability is easy to exploit, requiring only knowledge of the image storage path.
Recommendation
Immediately update the system to the latest version or apply a security patch. Additionally, implement file type validation and restrict permissions on the upload directory.
Original NVD description (English source)
Sourcecodester Doctor's Appointment System 1.0 is vulnerable to File Upload to RCE via Image upload from the administrator panel. An attacker can obtain remote command execution just by knowing the path where the images are stored.