CVE-2026-37598
Remote Code Execution in Patient Appointment Scheduler System v
Publication date: 2026-04-14
Last updated on: 2026-04-14
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sourcecodester | patient_appointment_scheduler_system | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in the Patient Appointment Scheduler System v1.0 allows remote code execution through arbitrary file upload, potentially leading to full system compromise.
Such a compromise could result in unauthorized access to sensitive patient data, which may violate data protection regulations like GDPR and HIPAA that require safeguarding personal health information and ensuring system security.
However, the provided information does not explicitly discuss the impact on compliance with these standards.
Can you explain this vulnerability to me?
The Patient Appointment Scheduler System v1.0 has a critical Remote Code Execution (RCE) vulnerability in the file scheduler/classes/SystemSettings.php at the endpoint ?f=update_settings.
This vulnerability allows an attacker to upload arbitrary PHP files by sending a specially crafted multipart/form-data POST request. The server does not properly validate or restrict the uploaded file types, enabling the attacker to upload malicious PHP code.
Once the malicious PHP file is uploaded to the server's upload directory, the attacker can execute the embedded code by accessing the file through a web browser, leading to remote code execution on the server.
The vulnerability is worsened by the system's default login credentials (admin/admin123), which if unchanged, may allow easier unauthorized access.
How can this vulnerability impact me? :
This vulnerability can lead to full system compromise because an attacker can execute arbitrary commands on the server.
By exploiting the arbitrary file upload flaw, attackers can run malicious PHP code, potentially gaining control over the server, accessing sensitive data, modifying or deleting files, and disrupting services.
If default credentials are not changed, attackers may also gain unauthorized administrative access, further increasing the risk and impact.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the system allows uploading arbitrary PHP files via the endpoint /scheduler/classes/SystemSettings.php?f=update_settings.
One way to test is to send a specially crafted multipart/form-data POST request to the URL ip/scheduler/classes/SystemSettings.php?f=update_settings with a PHP file (e.g., 1.php containing <?php phpinfo(); ?>) uploaded under the img parameter.
If the file uploads successfully and can be accessed and executed via a web browser (e.g., ip/scheduler/uploads/1.php), it confirms the vulnerability.
Commands to test this might include using curl to send the POST request with a PHP file payload.
- curl -X POST -F "name=test" -F "short_name=test" -F "about_us=test" -F "[email protected]" http://<target-ip>/scheduler/classes/SystemSettings.php?f=update_settings
After uploading, verify by accessing http://<target-ip>/scheduler/uploads/1.php in a browser to see if the PHP code executes.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or restricting file uploads to the vulnerable endpoint /scheduler/classes/SystemSettings.php?f=update_settings.
Ensure that the system properly validates and restricts uploaded file types, disallowing executable files such as PHP.
Change default credentials (admin/admin123) to strong, unique passwords to prevent unauthorized access.
If possible, restrict access to the upload directory and disable execution of uploaded files by configuring the web server to prevent execution of PHP files in the uploads folder.
Apply any available patches or updates from the vendor or developer to fix the vulnerability.