CVE-2022-40471

This exploit PoC demonstrates a remote code execution vulnerability in Clinic's Patient Management System v1.0 via an unrestricted file upload flaw in the profile picture functionality. It uploads a PHP webshell to achieve command execution.

This PoC demonstrates an authenticated file upload vulnerability in Clinic's Patient Management System (CPMS), allowing an attacker to upload a PHP web shell and execute arbitrary commands. The exploit authenticates using provided credentials and uploads a malicious PHP file via the profile image upload feature.

This Metasploit module exploits an SQL injection vulnerability in Clinic's Patient Management System 1.0 to achieve unauthenticated remote code execution (RCE) by uploading a malicious PHP file through user modification.

This Metasploit module exploits an unauthenticated file upload vulnerability in Clinic's Patient Management System 1.0, allowing an attacker to upload a PHP web shell and execute it via directory listing in `/pms/user_images`.