CVE-2022-30448
📋 TL;DR
CVE-2022-30448 is an unauthenticated file upload vulnerability in Hospital Management System (HMS) 1.0 that allows attackers to upload arbitrary files including malicious scripts to the server. This affects all deployments of HMS 1.0 using the vulnerable treatmentrecord.php component. Attackers can achieve remote code execution by uploading webshells.
💻 Affected Systems
- Hospital Management System (HMS)
📦 What is this software?
Hospital Management System by Hospital Management System Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to data theft, ransomware deployment, patient record manipulation, and lateral movement within hospital networks.
Likely Case
Attackers upload webshells to gain persistent access, steal sensitive patient data, and potentially disrupt hospital operations.
If Mitigated
With proper file upload validation and web application firewalls, exploitation attempts are blocked and logged.
🎯 Exploit Status
Simple HTTP POST request with malicious file upload bypasses validation. Multiple public references demonstrate exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
1. Replace treatmentrecord.php with patched version implementing proper file validation
2. Remove existing malicious files if already compromised
3. Implement input validation for all file upload endpoints
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock file uploads to treatmentrecord.php or restrict uploads to specific file types
WAF specific - configure rule to block .php, .phtml, .phar, .htaccess uploads
File System Restriction
linuxMove upload directory outside web root and restrict permissions
chmod 755 /var/www/html/uploads
mv /var/www/html/uploads /var/uploads
chown www-data:www-data /var/uploads
🧯 If You Can't Patch
- Disable treatmentrecord.php endpoint completely if not essential
- Implement network segmentation to isolate HMS from critical systems
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a test file (like test.txt) to treatmentrecord.php endpoint and check if it's saved without proper validationCheck Version:
Check source code for version identifier or review installation documentationVerify Fix Applied:
Test file upload with various extensions (.php, .phtml, .exe) - all should be rejected or properly validated📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to treatmentrecord.php
- POST requests with file uploads containing suspicious extensions
- Files with webshell patterns in upload directory
Network Indicators:
- HTTP POST requests to treatmentrecord.php with file uploads
- Subsequent requests to uploaded files with suspicious parameters
SIEM Query:
source="web_server" AND (uri="/treatmentrecord.php" AND method="POST" AND content_type="multipart/form-data")