CVE-2021-47758

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

C

hikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious PHP plugins through the module upload functionality. Authenticated attackers can generate and upload a ZIP plugin with a PHP backdoor that enables arbitrary command execution on the server through a weaponized PHP script.

References

Link	Resource
https://github.com/sanskruti-technologies/chikitsa	Product
https://sourceforge.net/projects/chikitsa/	Product
https://www.chikitsa.io/	Product
https://www.exploit-db.com/exploits/50571	Exploit VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:chikitsa:patient_management_system:2.0.2:*:*:*:*:*:*:*

History

03 Feb 2026, 17:53

Type	Values Removed	Values Added
References	~~() https://github.com/sanskruti-technologies/chikitsa -~~	() https://github.com/sanskruti-technologies/chikitsa - Product
References	~~() https://sourceforge.net/projects/chikitsa/ -~~	() https://sourceforge.net/projects/chikitsa/ - Product
References	~~() https://www.chikitsa.io/ -~~	() https://www.chikitsa.io/ - Product
References	~~() https://www.exploit-db.com/exploits/50571 -~~	() https://www.exploit-db.com/exploits/50571 - Exploit, VDB Entry
CPE		cpe:2.3:a:chikitsa:patient_management_system:2.0.2:::::::*
First Time		Chikitsa Chikitsa patient Management System

15 Jan 2026, 16:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-15 16:16

Updated : 2026-02-03 17:53

NVD link : CVE-2021-47758

Mitre link : CVE-2021-47758

CVE.ORG link : CVE-2021-47758

JSON object : View

Products Affected

patient_management_system

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2021-47758", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-01-15T16:16:06.677", "references": [{"url": "https://github.com/sanskruti-technologies/chikitsa", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://sourceforge.net/projects/chikitsa/", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://www.chikitsa.io/", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://www.exploit-db.com/exploits/50571", "tags": ["Exploit", "VDB Entry"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious PHP plugins through the module upload functionality. Authenticated attackers can generate and upload a ZIP plugin with a PHP backdoor that enables arbitrary command execution on the server through a weaponized PHP script."}], "lastModified": "2026-02-03T17:53:31.433", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:chikitsa:patient_management_system:2.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B5051D5-3E76-4B85-931A-332E8A59244F"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}