EUVD-2026-58713
GHSA-26xf-2hc8-jcmg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible upload requires high-privilege auth (PR:H); no scope change since impact is confined to the vulnerable application; limited C/I/A as upload alone does not guarantee full system compromise.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function save_doctor of the file /save_file.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit is now public and may be used.
AnalysisAI
Unrestricted file upload in SourceCodester Simple Doctors Appointment System 1.0 allows a remote, high-privilege attacker to upload arbitrary file types - including server-executable PHP scripts - via the save_doctor function at /save_file.php. The confidentiality, integrity, and availability impact is rated low-to-moderate per the CVSS 4.0 vector (5.1 Medium), as exploitation is constrained to authenticated sessions with high-privilege credentials. A public proof-of-concept exploit exists (GitHub issue linked from VulDB), though the vulnerability has not been added to the CISA KEV catalog.
Technical ContextAI
The affected endpoint, /save_file.php, implements a PHP function named save_doctor responsible for processing doctor profile data including file uploads. CWE-434 (Unrestricted Upload of File with Dangerous Type) describes the root cause: the application fails to validate uploaded file extensions, MIME types, or content against a server-side allowlist. This is a classic PHP unrestricted upload pattern where an attacker can substitute a PHP webshell in place of a legitimate image or document. The CPE cpe:2.3:a:sourcecodester:simple_doctors_appointment_system:*:*:*:*:*:*:*:* applies to all tracked versions of this PHP-based appointment management application distributed by SourceCodester (sourcecodester.com), a site that publishes open-source PHP demo projects primarily for educational use.
RemediationAI
No vendor-released patch has been identified at time of analysis. The SourceCodester project page (https://www.sourcecodester.com/) should be monitored for updates. Until a patch is available, administrators should implement server-side file type validation in /save_file.php by enforcing a strict allowlist of permitted extensions (e.g., jpg, png, pdf) and validating MIME type against file content using PHP's finfo_file() - blocking extensions alone is insufficient as bypass techniques exist. Uploaded files should be stored outside the web root or in a directory configured to deny PHP execution (e.g., via .htaccess: 'php_flag engine off'), preventing a successfully uploaded webshell from being executed via HTTP request. Access to the doctor management interface should be restricted to trusted administrative IP ranges where feasible, reducing the PR:H exploitation window even for credential-compromise scenarios.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today