CVE-2022-2297: ORETNOM23 Clinic's Patient Management System

High severity, CVSS 8.8. EPSS: 3.4% chance of exploitation in the next 30 days.

A vulnerability, which was classified as critical, was found in SourceCodester Clinics Patient Management System 2.0. Affected is an unknown function of the file /pms/update_user.php?user_id=1. The manipulation of the argument profile_picture with the input <?php phpinfo();?> leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products

• ORETNOM23 Clinic's Patient Management System: version 2.0 only

Published 2022-07-12. Last modified 2026-06-17.