CVE-2024-4809 is a medium severity unrestricted file upload flaw in SourceCodester Open Source Clinic Management System 1.0, scored 6.3. The logo field on the settings page accepts uploads without proper limits. The record lists no fix, so restrict access and treat any patient data it holds as at risk.
What's affected
The record names SourceCodester Open Source Clinic Management System 1.0. The file is setting.php and the logo argument leads to unrestricted upload. The weakness is CWE-434. The record says the attack can start remotely and the exploit is public. The only issue tracker link is a GitHub issue on a third party research account. The record lists no fixed version and I could not confirm one from the sources, so verify with the project before assuming a patch exists.
NVD scores 6.3 Medium with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, and VulDB's wording calls it critical. The KEV flag is false.
Clinic software raises the stakes more than most. It may hold health information, which many jurisdictions regulate strictly. A flaw that lets a server accept a file of the wrong kind needs more care in that setting.
How to check if you're exposed
- Search for Open Source Clinic Management System in your web roots and read the version.
- Locate where uploaded logos are stored and list the files there.
- Look for files that are not images, or images with extra extensions.
- Check whether that folder is served by the web server and whether scripts can run in it.
- Confirm who can log in to the settings page.
What to do now
- Take the application off the public internet.
- Stop the upload folder from running scripts, and allow only image types.
- Remove unexpected files and review access logs for them.
- Rotate admin passwords and database credentials.
- If real patient data lives in the system, involve your privacy officer.
- Plan a move to a maintained clinical system.
Why it matters
When an application stores files from users, it has to decide what they are, where they go, and whether the server may run them. Missing those checks is CWE-434. A logo field looks cosmetic but takes the same path as any other upload.
Defence is layered: check type and size, rename the file, store it outside the web root, and never let the upload folder run code. Scanning source for risky upload handlers before you ship catches many cases.
Quick check
Is there a patched version?
The record lists none. Confirm with the project before relying on any later release.
Sources
- Issue referenced by the record (not read)
- VulDB entry 263929 (not readable without a browser session)
- NVD record data for CVE-2024-4809
Last reviewed: 19 October 2026.
