CVE-2024-0265: Clinic Queuing System RCE Vulnerability

CVE-2024-0265 Overview

CVE-2024-0265 is a file inclusion vulnerability in SourceCodester Clinic Queuing System 1.0 developed by oretnom23. The flaw resides in the GET parameter handler within /index.php, where the page argument is passed to include logic without proper validation [CWE-73]. Attackers can manipulate the page parameter to load attacker-controlled files, leading to remote code execution when combined with writable log paths or uploadable content. The exploit has been publicly disclosed under VulDB identifier VDB-249821, and a working proof-of-concept is available in a public GitHub repository. The vulnerability is remotely exploitable and requires only low-privileged access.

Critical Impact
Authenticated remote attackers can achieve arbitrary file inclusion and code execution against the web application, compromising confidentiality, integrity, and availability of the host.

Affected Products

SourceCodester Clinic Queuing System 1.0
oretnom23 clinic_queuing_system version 1.0
CPE: cpe:2.3:a:oretnom23:clinic_queuing_system:1.0

Discovery Timeline

2024-01-07 - CVE-2024-0265 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0265

Vulnerability Analysis

The application accepts a user-supplied page parameter through an HTTP GET request to /index.php and passes it directly into a PHP include or require operation. Because no allowlist, sanitization, or canonicalization is performed, attackers can traverse the filesystem or reference remote resources depending on PHP configuration. Public exploitation tooling in the ClinicQueueingSystem_RCE repository chains the file inclusion primitive with log or session poisoning to execute PHP payloads. The vulnerability maps to CWE-73: External Control of File Name or Path.

Root Cause

The root cause is external control of a filename passed to a PHP include statement. The page GET parameter is concatenated into an include path without validating that the resolved target belongs to an approved set of application views. This design pattern permits both directory traversal sequences and inclusion of files whose contents an attacker can influence.

Attack Vector

Exploitation occurs over the network against the web interface. An attacker with a low-privileged application account issues a crafted GET request such as GET /index.php?page=<attacker-controlled-path>. The PHP interpreter loads and executes the referenced file. Public proof-of-concept code demonstrates automated exploitation. See the public PoC repository and the clinicx.py exploit script for the reference implementation.

// Vulnerability pattern - do not deploy
// Request shape: GET /index.php?page=<path>
// Vulnerable server-side pattern:
//   include($_GET['page'] . '.php');
// Attackers substitute traversal or log paths for <path>
// to force PHP to execute attacker-controlled content.

Detection Methods for CVE-2024-0265

Indicators of Compromise

HTTP requests to /index.php containing page= values with ../, null bytes, or absolute paths
Access log entries showing page parameters referencing /var/log/, /proc/self/environ, or PHP wrapper schemes such as php://filter or data://
Unexpected PHP processes spawning shell interpreters (sh, bash, cmd.exe) from the web server user
Outbound network connections initiated by the PHP-FPM or Apache worker processes to unrecognized hosts

Detection Strategies

Deploy web application firewall rules that inspect the page query parameter for path traversal and PHP wrapper schemes
Alert on any request to /index.php where page resolves outside the approved view directory
Correlate web request logs with new file writes in web-accessible directories and subsequent execution
Hunt for User-Agent strings matching public exploit tools targeting ClinicQueueingSystem_RCE

Monitoring Recommendations

Enable verbose Apache or Nginx access logging with full query string capture
Forward web server, PHP error, and host process telemetry to a centralized analytics platform for correlation
Baseline legitimate values of the page parameter and alert on deviations

How to Mitigate CVE-2024-0265

Immediate Actions Required

Restrict network access to the Clinic Queuing System web interface to trusted management networks only
Disable the application if it is not business-critical, given the availability of public exploit code and the elevated EPSS probability
Rotate credentials for any account that could log in to the application, since exploitation requires only low privileges
Review web server and PHP logs for prior exploitation attempts referencing the page parameter

Patch Information

No official vendor patch is referenced in the NVD entry for oretnom23 Clinic Queuing System 1.0. Administrators should treat the software as unpatched and consider replacing it or applying source-level fixes that validate the page parameter against a hardcoded allowlist of view names. Track updates at the VulDB advisory for any vendor response.

Workarounds

Modify /index.php to compare the page parameter against a fixed allowlist of view identifiers before including any file
Disable PHP allow_url_include and set open_basedir to restrict include paths to the application directory
Deploy WAF signatures blocking page parameter values containing ../, ://, or absolute filesystem paths
Run the PHP process under a least-privilege account with no write access to web-served directories

bash

# php.ini hardening to reduce file inclusion impact
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/clinic_queuing_system/:/tmp/"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"