PT-2026-3034 · Unknown · Chikitsa Patient Management System

0Z09E · Published 2026-01-15 · Updated 2026-01-20 · CVE-2021-47758

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chikitsa Patient Management System version 2.0.2

Description The software contains an authenticated remote code execution issue. Attackers can upload malicious PHP plugins through the module upload functionality. Authenticated attackers can create and upload a ZIP plugin containing a PHP backdoor, enabling arbitrary command execution on the server via a weaponized PHP script. The vulnerable functionality involves uploading modules.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the module upload functionality.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-47758

Affected Products

Chikitsa Patient Management System

References · 9

• 🔥 https://exploit-db.com/exploits/50571 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47758 · Security Note
• https://osv.dev/vulnerability/CVE-2021-47758 · Vendor Advisory
• https://github.com/sanskruti-technologies/chikitsa · Note
• https://twitter.com/CVEnew/status/2011926110033105248 · Twitter Post
• https://chikitsa.io · Note
• https://sourceforge.net/projects/chikitsa · Note
• https://twitter.com/cracbot/status/2013567243507114008 · Twitter Post
• https://twitter.com/CveFindCom/status/2011840865803604080 · Twitter Post