PT-2026-3034 · Unknown · Chikitsa Patient Management System

0Z09E · Publicado 2026-01-15 · Atualizado 2026-01-20 · CVE-2021-47758

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chikitsa Patient Management System version 2.0.2

Description The software contains an authenticated remote code execution issue. Attackers can upload malicious PHP plugins through the module upload functionality. Authenticated attackers can create and upload a ZIP plugin containing a PHP backdoor, enabling arbitrary command execution on the server via a weaponized PHP script. The vulnerable functionality involves uploading modules.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the module upload functionality.

Exploit

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2021-47758

Produtos afetados

Chikitsa Patient Management System

Referências · 9

• 🔥 https://exploit-db.com/exploits/50571 · Exploit
• https://github.com/sanskruti-technologies/chikitsa · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2021-47758 · Nota de Segurança
• https://twitter.com/CVEnew/status/2011926110033105248 · Publicação no Twitter
• https://chikitsa.io · Nota
• https://sourceforge.net/projects/chikitsa · Nota
• https://osv.dev/vulnerability/CVE-2021-47758 · Aviso do Fabricante
• https://twitter.com/cracbot/status/2013567243507114008 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2011840865803604080 · Publicação no Twitter