CVE-2023-33480

Summary

CVE-2023-33480 is a critical vulnerability chain affecting RemoteClinic 2.0. A remote attacker with low-privileged user credentials can exploit this vulnerability by sending specially crafted requests to the application. The flaw lies in the lack of input validation and access control in the staff/register.php endpoint and the edit-my-profile.php page. By manipulating these endpoints, an attacker can create admin users with elevated privileges, upload a PHP file, and execute arbitrary code on the target system through a PHP shell.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.