CVE-2022-28568
Last modified
CVE-2022-28568 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Sourcecodester Doctor's Appointment System 1.0 is vulnerable to File Upload to RCE via Image upload from the administrator panel. An attacker can obtain remote command execution just by knowing the path where the images are stored.. EPSS estimates a 4.06% chance of exploitation in the next 30 days.
Description
Sourcecodester Doctor's Appointment System 1.0 is vulnerable to File Upload to RCE via Image upload from the administrator panel. An attacker can obtain remote command execution just by knowing the path where the images are stored.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Simple Doctor\'S Appointment System Project | Simple Doctor\'S Appointment System | 1.0 |
References
- https://github.com/b3nj1-1/CVE/tree/main/CVE-2022-28568Exploit, Third Party Advisory
- https://github.com/b3nj1-1/CVE/tree/main/CVE-2022-28568Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-28568?
How severe is CVE-2022-28568?
How do I fix CVE-2022-28568?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-28552Cscms 4.1 is vulnerable to SQL Injection. Log into the backg…8.8
- CVE-2022-28556Tenda AC15 US_AC15V1.0BR_V15.03.05.20_multi_TDE01.bin is vul…7.5
- CVE-2022-28557There is a command injection vulnerability at the /goform/se…9.8
- CVE-2022-2856Insufficient validation of untrusted input in Intents in Goo…6.5
- CVE-2022-28560There is a stack overflow vulnerability in the goform/fast_s…9.8
- CVE-2022-28561There is a stack overflow vulnerability in the /goform/setMa…9.8
- CVE-2022-2857Use after free in Blink in Google Chrome prior to 104.0.5112…8.8
- CVE-2022-28571D-link 882 DIR882A1_FW130B06 was discovered to contain a com…9.8
- CVE-2022-28572Tenda AX1806 v1.0.0.1 was discovered to contain a command in…8.8
- CVE-2022-28573D-Link DIR-823-Pro v1.0.2 was discovered to contain a comman…9.8
- CVE-2022-28575It is found that there is a command injection vulnerability …9.8
- CVE-2022-28577It is found that there is a command injection vulnerability …9.8
Are you affected by CVE-2022-28568?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST