CVE-2022-2297
Published: 12 July 2022
Summary
CVE-2022-2297 is a medium-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Oretnom23 Clinic\'S Patient Management System. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 1.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2022-2297 is an unrestricted file upload vulnerability, tracked under CWE-434, that affects SourceCodester Clinics Patient Management System version 2.0. The flaw resides in an unspecified function within the file /pms/update_user.php when handling the profile_picture parameter; supplying a PHP payload such as <?php phpinfo();?> bypasses restrictions and permits arbitrary file placement on the server.
An authenticated attacker with low privileges can exploit the issue remotely by submitting a crafted profile picture upload. Successful exploitation grants the ability to execute arbitrary PHP code on the target system, resulting in partial impacts to confidentiality, integrity, and availability as reflected in the CVSS 6.3 vector.
Public proof-of-concept code has been released on GitHub, and the EPSS score rose from a low baseline to a peak of 0.6997 before settling at the current value of 0.5828, indicating that exploitation interest increased after disclosure. No vendor advisory or patch details appear in the referenced sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-34570
Vulnerability details
A vulnerability, which was classified as critical, was found in SourceCodester Clinics Patient Management System 2.0. Affected is an unknown function of the file /pms/update_user.php?user_id=1. The manipulation of the argument profile_picture with the input <?php phpinfo();?> leads to unrestricted upload.…
more
It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.