high8.8
CVE-2023-24610
NOSH 4a5cfdb allows remote authenticated users to execute PHP arbitrary code via the "practice logo" upload feature.
Impact
NOSH 4a5cfdb allows remote authenticated users to execute PHP arbitrary code via the "practice logo" upload feature. The client-side checks can be bypassed. This may allow attackers to steal Protected Health Information because the product is for health charting.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nosh Chartingsystem Project | Nosh Chartingsystem | Version 2021-03-13 |
Weakness classification
References
- NVD record
- CVE.org record
- https://gist.github.com/abbisQQ/d8392acf7e02003e73af973cc9f5f54a
- https://github.com/shihjay2/docker-nosh
- https://github.com/shihjay2/nosh2/tree/4a5cfdbd73f6a2ab5ee43a33d173c46fe0271533
- https://noshemr.wordpress.com
- https://gist.github.com/abbisQQ/d8392acf7e02003e73af973cc9f5f54a
- https://github.com/shihjay2/docker-nosh
- https://github.com/shihjay2/nosh2/tree/4a5cfdbd73f6a2ab5ee43a33d173c46fe0271533
- https://noshemr.wordpress.com