Cyber Posture

CVE-2021-47758

HighPublic PoC

Published: 15 January 2026

Published
15 January 2026
Modified
03 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0066 71.2th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious PHP plugins through the module upload functionality. Authenticated attackers can generate and upload a ZIP plugin with a PHP backdoor that enables…

more

arbitrary command execution on the server through a weaponized PHP script.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Validates uploaded ZIP files and their contents to block malicious PHP backdoors, directly addressing the unrestricted upload of dangerous file types leading to RCE.

SI-2 Flaw Remediation good match
prevent

Identifies, prioritizes, and remediates the specific flaw in the module upload functionality, preventing exploitation of this CVE through timely patching.

SI-3 Malicious Code Protection good match
preventdetect

Deploys malicious code protection at the upload entry point to scan and eradicate PHP backdoors in ZIP plugins before execution.

Security SummaryAI

CVE-2021-47758 is an authenticated remote code execution vulnerability affecting Chikitsa Patient Management System version 2.0.2. The issue stems from the module upload functionality, which permits attackers to upload malicious PHP plugins packaged as ZIP files containing weaponized PHP scripts that function as backdoors.

Authenticated attackers with low privileges can exploit this vulnerability remotely over the network with low attack complexity and no user interaction. Exploitation allows the generation and upload of a ZIP plugin embedding a PHP backdoor, enabling arbitrary command execution on the server and resulting in high impacts to confidentiality, integrity, and availability, as indicated by the CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and association with CWE-434 (Unrestricted Upload of File with Dangerous Type).

References point to the project's GitHub repository at https://github.com/sanskruti-technologies/chikitsa, SourceForge page at https://sourceforge.net/projects/chikitsa/, official site at https://www.chikitsa.io/, and an Exploit-DB entry at https://www.exploit-db.com/exploits/50571, but no specific advisories or patch details are detailed in the provided information.

Details

CWE(s)
CWE-434

Affected Products

chikitsa
patient management system
2.0.2

AI Security AnalysisAI

AI Category
Other AI Platforms
Risk Domain
N/A
OWASP Top 10 for LLMs 2025
None mapped
MITRE ATLAS Techniques
None mapped
Classification Reason
Matched keywords: backdoor

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

The vulnerability allows authenticated attackers to upload ZIP files containing malicious PHP backdoors (web shells) to a public-facing web application, enabling remote code execution (T1190: Exploit Public-Facing Application, T1505.003: Web Shell).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References