An unauthenticated arbitrary file upload vulnerability in the rickxy Hospital Management System allows remote attackers to execute malicious code, potentially leading to a full system compromise.

The application fails to validate the file extension and MIME type of uploaded files through the ad_dpic parameter within the /backend/admin/his_admin_account.php file, while simultaneously lacking necessary session or cookie authentication checks. This flaw allows an unauthenticated attacker to upload and execute arbitrary PHP scripts on the server.

The ability for an unauthenticated attacker to achieve Remote Code Execution creates a critical security risk, potentially resulting in complete server takeover, unauthorized access to sensitive patient medical data, and significant operational disruption. While the CVSS score of 7.3 reflects the severity of the access and impact, the ability to gain full administrative control over the application environment necessitates immediate remediation to prevent data breaches and maintain regulatory compliance.

Immediate Action: Since no official patch is currently available, administrators must restrict access to the /backend/admin/ directory using network-level controls or web server authentication. Additionally, implement server-side configuration changes to disable the execution of PHP scripts within the /backend/admin/assets/images/users/ directory.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at /backend/admin/his_admin_account.php, particularly those containing non-image file extensions or suspicious payload patterns. Monitor the application upload directory for the presence of unexpected files or scripts.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block incoming requests to the vulnerable endpoint that attempt to upload files with non-image extensions or suspicious MIME types.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the researcher write-up linked by the CVE record.

Given the critical nature of an unauthenticated Remote Code Execution vulnerability, organizations utilizing this software must prioritize the implementation of the recommended compensating controls immediately. Until a vendor-supplied patch is released, the risk of total system compromise remains high, and administrators should consider isolating the application from the public internet entirely if it cannot be adequately secured.