External risk intelligence

Sourcecodester Doctor's Appointment System Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-28568

This is a web application designed for appointment management. Such applications are commonly deployed as web services intended to be accessible to users over the internet, making the administrative panel and its associated functions likely to have exposure in many real-world environments.

Unrestricted File Upload

Simple Doctor\'s Appointment System Project Simple Doctor\'s Appointment System

1.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Sourcecodester Doctor's Appointment System, allowing for remote command execution by exploiting a file upload feature. This means an attacker could potentially take control of the system if they know where uploaded images are stored, posing a significant risk to data and system integrity.

Unrestricted file uploads can lead to system compromise.
Critical vulnerability impacts web appointment systems.
Assess system exposure and potential unauthorized control.

Attack Path

How an attacker could exploit the issue

An attacker could gain remote control of the system by uploading a malicious image through the administrator panel. This is possible because the system improperly handles file uploads, allowing an attacker to place executable code on the server, which can then be triggered. The primary risk arises from knowing the storage path of uploaded images, enabling the execution of arbitrary commands.

No authentication or user interaction needed.
Upload a malicious image file.
Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary commands on the server by uploading a malicious file through the administrator panel, provided the attacker knows the storage path for uploaded images.

Server-side code execution.
Exploited via malicious image upload.
Potential for system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Sourcecodester Doctor's Appointment System, specifically version 1.0, presents a critical remote command execution vulnerability through its file upload functionality. Technical leaders and security teams should prioritize identifying instances of this system within their environment, assessing their exposure and business criticality, and confirming the accountable owner to initiate a risk-based remediation plan.

Application owners and infrastructure teams are responsible.
Verify system presence and external reachability first.
Plan remediation based on identified risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Sourcecodester Doctor's Appointment System?

It is a web-based application designed to manage clinic or practice scheduling. Users and administrators interact with it to handle patient bookings, typically deployed on a web server to allow remote access to the appointment dashboard.

How does CVE-2022-28568 lead to remote code execution?

This vulnerability involves an Unrestricted Upload of File with Dangerous Type (CWE-434). The system fails to properly validate files uploaded through the administrator panel, allowing an attacker to store malicious scripts on the server. Because the server processes these files, the attacker can force the system to execute unauthorized commands.

Do I need to be logged in to trigger this vulnerability?

No. The flaw does not require authentication or user interaction to exploit. An attacker can initiate the malicious upload directly. However, the attack relies on the ability to determine the specific file path where the application saves uploaded images to trigger the stored code.

Is my system at high risk if it is internal-only?

Halo Surface Signal indicates that appointment systems are often deployed as internet-facing services, which significantly increases risk. If your instance is strictly internal, it may be less visible to external actors, but the vulnerability remains critical if any user or service can reach the admin panel.

How should I respond to this vulnerability?

First, locate and identify all running instances of version 1.0 of the software within your environment. Once identified, evaluate the system's accessibility and criticality. Consult with the application owner to restrict access to the administrator panel and establish a plan to mitigate or remove the vulnerable file upload component.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.