CVE-2026-5181: Doctors Appointment System File Upload Flaw

CVE-2026-5181 Overview

A vulnerability has been identified in SourceCodester Simple Doctors Appointment System up to version 1.0. This issue affects the file /doctors_appointment/admin/ajax.php?action=save_category where manipulation of the img argument leads to unrestricted file upload. The vulnerability can be exploited remotely by authenticated attackers, and exploit information has been publicly disclosed.

Critical Impact

Unrestricted file upload vulnerabilities allow attackers to upload malicious files such as web shells or backdoors, potentially leading to complete server compromise and remote code execution.

Affected Products

• SourceCodester Simple Doctors Appointment System version 1.0 and earlier
• Deployments using the vulnerable /admin/ajax.php endpoint
• Systems with the save_category action enabled

Discovery Timeline

• 2026-03-31 - CVE-2026-5181 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-5181

Vulnerability Analysis

This vulnerability exists in the SourceCodester Simple Doctors Appointment System's administrative file upload functionality. The affected endpoint /doctors_appointment/admin/ajax.php?action=save_category fails to properly validate uploaded files through the img parameter. The weakness is classified under CWE-284 (Improper Access Control), indicating that the application does not adequately restrict what types of files can be uploaded or verify the contents of uploaded files.

When processing category image uploads, the application accepts files without checking file extensions, MIME types, or file content signatures. This allows an attacker with authenticated access to the admin panel to upload arbitrary files, including executable scripts such as PHP web shells.

Root Cause

The root cause of this vulnerability is improper input validation and missing file type restrictions in the save_category action handler. The application fails to implement server-side validation to ensure that only legitimate image files (such as PNG, JPG, or GIF) are accepted. Without proper checks on file extensions, MIME types, and magic bytes, the upload mechanism accepts any file type provided by the user.

Attack Vector

The attack can be performed remotely over the network by an authenticated user with access to the administrative interface. An attacker would craft a malicious file (such as a PHP web shell) and upload it through the category image upload feature. Once uploaded, the attacker can access the malicious file directly via its URL path on the server, achieving arbitrary code execution.

The vulnerability requires low privileges (authenticated admin access) and no user interaction, making it relatively straightforward to exploit once administrative credentials are obtained.

For technical details and proof-of-concept information, refer to the GitHub Issue Discussion and VulDB Vulnerability Report.

Detection Methods for CVE-2026-5181

Indicators of Compromise

• Unexpected files with executable extensions (.php, .phtml, .php5) appearing in upload directories
• Web server logs showing requests to the /doctors_appointment/admin/ajax.php?action=save_category endpoint followed by requests to unusual file paths
• New or modified files in the category image upload directory that do not match expected image file patterns

Detection Strategies

• Monitor file system changes in the web application's upload directories for non-image file types
• Implement web application firewall (WAF) rules to detect file upload attempts with suspicious extensions
• Review web server access logs for patterns indicating exploitation attempts against the vulnerable endpoint

Monitoring Recommendations

• Enable file integrity monitoring on the web application's upload directories
• Configure alerting for any HTTP POST requests to ajax.php?action=save_category that include files with executable extensions
• Audit administrative account activity for unusual login patterns or upload behaviors

How to Mitigate CVE-2026-5181

Immediate Actions Required

• Restrict access to the administrative panel using IP whitelisting or VPN requirements
• Disable or remove the save_category functionality if not required for business operations
• Review and remove any suspicious files from upload directories
• Ensure strong authentication mechanisms and unique credentials for all admin accounts

Patch Information

No official vendor patch has been identified in the available CVE data. Organizations using this software should monitor SourceCodester for updates. Given the software is from an open-source code sharing platform, consider implementing custom patches or migrating to a more actively maintained solution.

For additional technical context, see the VulDB CTI Analysis and VulDB Submission Entry.

Workarounds

• Implement server-side file validation that checks file extensions, MIME types, and magic bytes before accepting uploads
• Configure the web server to prevent execution of scripts in upload directories (e.g., disable PHP execution in those folders)
• Use a content delivery network or separate storage location for uploaded files that does not allow script execution
• Apply web application firewall rules to block requests with suspicious file upload patterns

# Configuration example - Disable PHP execution in upload directories (Apache .htaccess)
# Place this in the upload directory to prevent script execution
php_flag engine off

# Alternative: For nginx, add to location block for upload directory
# location /doctors_appointment/uploads/ {
#     location ~ \.php$ { deny all; }
# }