PT-2022-25919 · Unknown · Online Diagnostic Lab Management System
CVE-2022-41533
·
Published
2022-10-13
·
Updated
2022-10-14
CVSS v3.1
7.2
High
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Online Diagnostic Lab Management System version 1.0
Description
The issue allows attackers to execute arbitrary code via a crafted PHP file, leveraging an arbitrary file upload vulnerability in the /php action/editProductImage.php component.
Recommendations
For version 1.0, consider disabling the /php action/editProductImage.php component until a patch is available to prevent arbitrary file uploads and subsequent code execution.
Exploit
Fix
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Online Diagnostic Lab Management System