Attack Chain

1. Attacker performs reconnaissance to identify systems running itsourcecode Online Pharmacy System 1.0.
2. Attacker navigates to the public user registration page located at /all_users/register.php.
3. Attacker initiates a registration request, intercepting the HTTP request using a proxy tool.
4. Attacker modifies the 'photo' parameter in the POST request to point to a malicious file, such as a PHP web shell.
5. The application's 'move_uploaded_file' function processes the malicious request without validating the file extension or content.
6. The web server saves the attacker-supplied file into a directory accessible by the web root.
7. Attacker requests the newly uploaded file via the browser to trigger execution of the malicious script.
8. Attacker achieves remote command execution with the privileges of the web server service account.

Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to gain remote code execution on the underlying server. This can lead to full system compromise, data theft, ransomware deployment, or use of the server as a pivot point for further lateral movement within the target organization's network. Given the nature of the application as a pharmacy management system, the potential exposure of sensitive patient and operational data is significant.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Deploy a web application firewall (WAF) rule to inspect and block requests to '/all_users/register.php' that contain suspicious file extensions (e.g., .php, .php5, .phtml) within the 'photo' parameter.
• Implement monitoring for new file creation events within the web directory where user-uploaded photos are stored.
• Audit the web server configuration to ensure that file execution permissions are restricted in user upload directories.
• Identify and decommission any production instances of 'Online Pharmacy System' 1.0 until a security patch is provided by the vendor.