An unauthenticated remote code execution vulnerability in Projectworlds Remote Clinic System 2.0 allows attackers to upload and execute malicious files on the server.

This is an unrestricted file upload vulnerability (CWE-434) located within the /staff/edit-my-profile.php file. The application fails to validate the file type or content of the image parameter, allowing an unauthenticated attacker to upload and subsequently execute malicious scripts on the server.

Successful exploitation of this vulnerability allows an attacker to gain full control over the underlying web server. This can lead to complete data compromise, unauthorized access to sensitive patient records, the installation of persistent malware, and potential service disruption. With a CVSS score of 7.3, this represents a significant security risk that requires urgent attention to prevent system-wide compromise.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /staff/edit-my-profile.php endpoint or disable the file upload functionality entirely until a secure update is released.

Proactive Monitoring: Security teams should review web server access logs for suspicious POST requests targeting the /staff/edit-my-profile.php file, particularly those involving file extensions other than standard image formats.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block incoming requests that attempt to upload files with suspicious extensions or non-image MIME types to the affected directory.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher's GitHub repository.

Given the availability of a public proof-of-concept and the high risk associated with remote code execution, this vulnerability poses a severe threat to any environment hosting the Remote Clinic System. Administrators must prioritize isolating the affected application from public networks or implementing strict request filtering until the vendor provides a formal security update.