Exploit for CVE-2022-40471 exploit

Share

## https://sploitus.com/exploit?id=AFF2402E-57B2-57D9-A94F-8E088095B4BB # CVE-2022-40471 Remote code execution via unrestricted file upload vulnerability in the Clinic's Patient Management System v 1.0  # Technical description: Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php Affected components - Source Code, Vulnerable Page - users.php # CVE-2022-40471.py usage - ```sh # Upload a simple webshell to the target machine - python3 CVE-2022-40471.py <target_ip> <target_port> <target_uri> <username> <password> ``` ## Example - ```sh python CVE-2022-40471.py 127.0.0.1 80 /pms/ UserName Password ``` # Proof of concept (Poc) -  # References - https://drive.google.com/file/d/1m-wTfOL5gY3huaSEM3YPSf98qIrkl-TW/view?usp=sharing https://www.sourcecodester.com/php-clinics-patient-management-system-source-code https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-cpms.zip # Discovered by - RashidKhan Pathan (iHexCoder), 9 September 2022. Twitter: @itRashid