HospitalManagementSystem CVE-2026-104637

Exploitation requires reaching the controller.php actions add_patient, add_physician, add_account, update_account, update_subaccount, edit_physician, or edit_patient and submitting a crafted file through the 'img' argument that evades file-type/extension validation; successful code execution additionally requires the upload destination to be within a web-accessible directory with script execution enabled. The input CVSS asserts no authentication (PR:N), but these are account/record-management operations normally gated behind an authenticated admin/staff session - if the panel enforces login, valid credentials or a session are a practical prerequisite, which is the key limiting factor defenders should confirm. No special non-default configuration is otherwise named in the description.

Signals are mixed and point to a low-to-moderate real-world priority. The input CVSS 4.0 base score is 5.5 (medium) with vector AV:N/AC:L/PR:N/UI:N and only Low impact across VC/VI/VA, and E:P indicating a proof-of-concept exploit maturity. A proof-of-concept is publicly available (referenced as the GitHub issue), but this CVE is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active or widespread exploitation - POC availability alone must not be read as in-the-wild attacks. The most important tension is PR:N versus the nature of the affected functions: the vulnerable endpoints (add_patient/add_physician/add_account/update_account/edit_physician/edit_patient in controller.php) are account- and record-management operations that in practice almost always sit behind an authenticated panel, so the vendor/VulDB PR:N rating likely overstates reachability - verify whether these controller actions are exposed pre-authentication. Equally, a CWE-434 unrestricted file upload that lands a script in a web-accessible path typically yields code execution, which would justify far higher than the Low C/I/A the input assigns; the impact may be understated. Net: this is a credible flaw with public POC, but its effective risk is tempered by probable authentication requirements and the product's negligible deployment footprint, making it a lower priority than its CWE class would suggest absent confirmation of unauthenticated reachability.

An attacker with access to the HospitalManagementSystem web panel invokes one of the account/record management actions (e.g. add_account or edit_physician) and supplies a malicious file via the 'img' parameter, bypassing file-type restrictions to upload a PHP web shell. If the upload directory is web-accessible, the attacker then requests the uploaded script to execute arbitrary code on the server. A public proof-of-concept exists (published via the project's GitHub issue tracker), lowering the skill barrier.