Description
Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Clinic's Patient Management System 1.0 - Unauthenticated RCE
exploit/multi/http/clinic_pms_fileupload_rce
GitHub 2 repositories
-
RashidKhanPathan/CVE-2022-40471 ★ 12 · Oct 12, 2022
RCE Exploit and Research
-
Dharan10/CVE-2022-40471 ★ 0 · Dec 30, 2025
Exploit code for Clinic patient management system v1 unauth rce cpms rce CVE-2022-40471
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.