// For flags

CVE-2023-33480

 

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

RemoteClinic 2.0 contains a critical vulnerability chain that can be exploited by a remote attacker with low-privileged user credentials to create admin users, escalate privileges, and execute arbitrary code on the target system via a PHP shell. The vulnerabilities are caused by a lack of input validation and access control in the staff/register.php endpoint and the edit-my-profile.php page. By sending a series of specially crafted requests to the RemoteClinic application, an attacker can create admin users with more privileges than their own, upload a PHP file containing arbitrary code, and execute arbitrary commands via the PHP shell.

RemoteClinic 2.0 contiene una cadena de vulnerabilidad crítica que puede ser explotada por un atacante remoto con credenciales de usuario con pocos privilegios para crear usuarios administradores, escalar privilegios y ejecutar código arbitrario en el sistema de destino a través de un shell PHP. Las vulnerabilidades se deben a la falta de validación de entradas y control de acceso en el endpoint staff/register.php y en la página edit-my-profile.php. Al enviar una serie de solicitudes especialmente manipuladas a la aplicación RemoteClinic, un atacante puede crear usuarios administradores con más privilegios que los suyos, cargar un archivo PHP que contiene código arbitrario y ejecutar comandos arbitrarios a través del shell PHP.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2023-05-22 CVE Reserved
  • 2023-11-07 CVE Published
  • 2024-09-05 CVE Updated
  • 2024-09-05 First Exploit
  • 2024-10-07 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
References (1)
URL Tag Source
URL Date SRC
https://github.com/remoteclinic/RemoteClinic/issues/24 2024-09-05
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Remoteclinic
Search vendor "Remoteclinic"
 Remote Clinic
Search vendor "Remoteclinic" for product "Remote Clinic"
 2.0
Search vendor "Remoteclinic" for product "Remote Clinic" and version "2.0"
-
Affected