CVE-2022-28568: n/a Doctor's Appointment System:

CISO Take

This CVE affects Sourcecodester's Doctor's Appointment System, a niche standalone PHP web application — it is not an AI/ML product, despite being tagged with an ml_ui category in this feed, which appears to be a classification error since the affected product record is unresolved ('n/a/unknown') and no AI package in our tracked catalog matches it. The flaw lets someone with access to the administrator panel upload a disguised malicious file through the image-upload feature and then achieve remote code execution simply by requesting the predictable storage path directly over HTTP, with no further authentication needed at that point. There is no CISA KEV listing, no public Metasploit or Nuclei module, and the EPSS score of 0.03 reflects a low absolute exploitation probability even though it ranks in the top 14th percentile — a reminder that percentile rank alone can overstate urgency when the raw score is small. No AI/ML framework, model-serving stack, or pipeline in your environment is implicated by this specific CVE. If your organization actually runs this product, take it offline or isolate it and disable script execution in the upload directory, since no vendor patch is referenced; otherwise, flag this record for re-classification out of the AI threat feed rather than treating it as an AI-specific risk.

Sources: NVD EPSS

What is the risk?

Low relevance to AI/ML risk posture — this is a generic PHP web application vulnerability with no connection to any AI/ML framework, model, or inference pipeline. For organizations that do run this specific unmaintained Sourcecodester product, the technical risk is meaningful (low attack complexity, full RCE), but exposure is narrow since this is a niche appointment-scheduling app, not a widely deployed AI component. No CISA KEV status, no public exploit tooling, and a low EPSS score (0.03) further reduce near-term exploitation likelihood at internet scale.

How does the attack unfold?

Initial Access

Attacker gains access to the administrator panel (often via weak/default credentials) and uses the image upload feature to plant a disguised PHP webshell.

AML.T0049

Path Discovery

Attacker determines or guesses the predictable storage path where uploaded images are saved on the web server.

Remote Code Execution

Attacker requests the uploaded webshell directly over HTTP, causing the server to execute attacker-supplied code.

AML.T0050

Impact

Attacker gains full control of the underlying host, enabling data theft, lateral movement, or further compromise of co-located systems.

Initial Access

Attacker gains access to the administrator panel (often via weak/default credentials) and uses the image upload feature to plant a disguised PHP webshell.

AML.T0049

Path Discovery

Attacker determines or guesses the predictable storage path where uploaded images are saved on the web server.

Remote Code Execution

Attacker requests the uploaded webshell directly over HTTP, causing the server to execute attacker-supplied code.

AML.T0050

Impact

Attacker gains full control of the underlying host, enabling data theft, lateral movement, or further compromise of co-located systems.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n/a	—	—	No patch

Do you use n/a? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

3.1%

chance of exploitation in 30 days

Higher than 87% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

No vendor-supplied patched version is referenced in this record, so treat as unpatched: (1) take the application offline or restrict administrator panel access to a trusted network/VPN; (2) disable script execution in the image-upload directory at the web server level (e.g., deny .php execution via nginx/Apache config); (3) enforce server-side file-type validation (content sniffing, not just extension checks) on all uploads; (4) randomize or obscure upload storage paths so they cannot be guessed; (5) monitor web server logs for unexpected requests to the uploads directory and for anomalous outbound connections from the host; (6) if this product is business-critical, plan migration to a maintained alternative, as Sourcecodester-class apps typically receive no ongoing security support.

How is it classified?

Code Execution Framework

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2022-28568?

This CVE affects Sourcecodester's Doctor's Appointment System, a niche standalone PHP web application — it is not an AI/ML product, despite being tagged with an ml_ui category in this feed, which appears to be a classification error since the affected product record is unresolved ('n/a/unknown') and no AI package in our tracked catalog matches it. The flaw lets someone with access to the administrator panel upload a disguised malicious file through the image-upload feature and then achieve remote code execution simply by requesting the predictable storage path directly over HTTP, with no further authentication needed at that point. There is no CISA KEV listing, no public Metasploit or Nuclei module, and the EPSS score of 0.03 reflects a low absolute exploitation probability even though it ranks in the top 14th percentile — a reminder that percentile rank alone can overstate urgency when the raw score is small. No AI/ML framework, model-serving stack, or pipeline in your environment is implicated by this specific CVE. If your organization actually runs this product, take it offline or isolate it and disable script execution in the upload directory, since no vendor patch is referenced; otherwise, flag this record for re-classification out of the AI threat feed rather than treating it as an AI-specific risk.

Is CVE-2022-28568 actively exploited?

No confirmed active exploitation of CVE-2022-28568 has been reported, but organizations should still patch proactively.

How to fix CVE-2022-28568?

No vendor-supplied patched version is referenced in this record, so treat as unpatched: (1) take the application offline or restrict administrator panel access to a trusted network/VPN; (2) disable script execution in the image-upload directory at the web server level (e.g., deny .php execution via nginx/Apache config); (3) enforce server-side file-type validation (content sniffing, not just extension checks) on all uploads; (4) randomize or obscure upload storage paths so they cannot be guessed; (5) monitor web server logs for unexpected requests to the uploads directory and for anomalous outbound connections from the host; (6) if this product is business-critical, plan migration to a maintained alternative, as Sourcecodester-class apps typically receive no ongoing security support.

What is the CVSS score for CVE-2022-28568?

No CVSS score has been assigned yet.

What are the technical details?

Original Advisory

Sourcecodester Doctor's Appointment System 1.0 is vulnerable to File Upload to RCE via Image upload from the administrator panel. An attacker can obtain remote command execution just by knowing the path where the images are stored.

Exploitation Scenario

An attacker first obtains access to the administrator panel — commonly via default or weak credentials, which is typical for this class of low-maintenance PHP application. Using the legitimate image-upload feature, they upload a file crafted to look like an image but containing executable PHP webshell code. Because the application does not validate execution context on uploaded files, the attacker then simply requests the known or guessable storage path directly over HTTP, causing the server to execute their code and hand them a remote shell on the host.