Description

A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function save_doctor of the file /save_file.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit is now public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-14T17:17:34.803Z",
  "pubdate": "2026-08-14T17:17:34.803Z",
  "executiveSummary": "A critical security vulnerability has been identified in SourceCodester Simple Doctors Appointment System 1.0, specifically within the save_doctor function located in /save_file.php. This vulnerability is classified as an unrestricted file upload flaw, which enables remote attackers to bypass security controls and upload arbitrary files directly to the underlying server hosting the application.\nThe primary impact of this security deficiency includes potential remote code execution, system compromise, unauthorized data access, and complete integrity loss of the web server environment. The risk implications are severe due to the public availability of exploit details, which significantly lowers the barrier to entry for malicious actors seeking to target vulnerable installations.\nExploitation of this vulnerability requires network access to the target web application, specifically targeting the vulnerable endpoint associated with doctor record creation or file management. The attacker capabilities required are relatively low, as remote execution is feasible without prior authentication unless explicitly restricted by secondary application logic. Successful exploitation allows an adversary to upload malicious scripts, such as web shells, facilitating persistent access and further lateral movement within the network infrastructure.",
  "technicalDetails": "The vulnerability resides in the save_doctor function implemented within the /save_file.php script of SourceCodester Simple Doctors Appointment System 1.0. The root cause of the issue stems from improper input validation and the complete absence of file type, extension, and content verification mechanisms during the file upload process.\nFrom an architectural perspective, the vulnerable component handles multipart HTTP POST requests containing file uploads submitted by users. When the save_doctor function processes incoming requests, it fails to enforce strict allowlists for permitted file extensions (e.g., restricting uploads exclusively to safe image formats like JPEG or PNG). Furthermore, the application does not sanitize file names, nor does it store uploaded files in a secure, non-executable directory outside of the web root.\nThe step-by-step attack flow proceeds as follows. First, an attacker crafts a malicious HTTP POST request targeting the /save_file.php endpoint. The payload incorporates a malicious script, such as a PHP web shell, disguised or injected through the parameter processed by the save_doctor function. Second, the server-side script accepts the file stream without validating the MIME type or checking the file extension. Third, the application writes the malicious file to a publicly accessible directory on the web server.\nOnce the file is successfully written to the disk, the attacker executes the payload by making a direct HTTP GET request to the uploaded file's path. Because the web server processes files with execution permissions in that directory, the embedded script executes within the security context of the web server user process.\nNetwork exposure is fully remote over HTTP or HTTPS. Authentication and privilege requirements depend on the default application configuration; however, endpoints handling administrative or profile creation functions like save_doctor are frequently exposed without adequate session validation, permitting unauthenticated or low-privileged remote attackers to trigger the vulnerability. Post-exploitation impact includes full system compromise, unauthorized execution of arbitrary system commands, data exfiltration, and establishment of persistent backdoor access."
}