📄 Description (English)
Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability in the backup restoration functionality. Authenticated attackers can upload a modified backup zip file with a malicious PHP shell to execute arbitrary system commands on the server.
🤖 AI Executive Summary
CVE-2021-47757 is a critical authenticated remote code execution vulnerability in Chikitsa Patient Management System 2.0.2 that allows attackers with valid credentials to upload malicious backup files containing PHP shells, leading to arbitrary command execution on healthcare servers. With an 8.8 CVSS score and publicly available exploits, this poses an immediate threat to healthcare organizations storing sensitive patient data. The vulnerability requires user authentication but can be exploited by compromised internal accounts or malicious insiders.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: Apr 22, 2026 01:57
🇸🇦 Saudi Arabia Impact Assessment
This vulnerability directly impacts Saudi healthcare organizations using Chikitsa PMS, including private hospitals, clinics, and health information systems. Primary risk sectors: Healthcare (MOH facilities, private hospitals, diagnostic centers), Government health agencies, and any organization managing patient records. The vulnerability enables attackers to access Protected Health Information (PHI) under GDPR/PDPA equivalents, disrupt healthcare services, and establish persistent backdoors. Saudi healthcare sector's increasing digitalization makes this particularly critical for SEHA, private hospital chains, and diagnostic centers relying on patient management systems.
🏢 Affected Saudi Sectors
Healthcare
Government Health Agencies
Private Hospitals and Clinics
Diagnostic Centers
Pharmaceutical Companies
Medical Research Institutions
Health Insurance Companies
🎯 MITRE ATT&CK Techniques
T1190 - Exploit Public-Facing Application
T1199 - Trusted Relationship
T1566 - Phishing
T1598 - Phishing for Information
T1110 - Brute Force
T1078 - Valid Accounts
T1190 - Exploit Public-Facing Application
T1505 - Server Software Component
T1505.003 - Web Shell
T1059 - Command and Scripting Interpreter
T1059.004 - Unix Shell
T1059.001 - PowerShell
T1583 - Acquire Infrastructure
T1608 - Stage Capabilities
⚖️ Saudi Risk Score (AI)
8.5
/ 10.0
🔧 Remediation Steps (English)
IMMEDIATE ACTIONS:
1. Identify all instances of Chikitsa PMS 2.0.2 in your environment and isolate affected systems from production networks if possible
2. Review access logs for backup restoration functionality (typically /admin/backup or /restore endpoints) for suspicious activities
3. Restrict backup restoration functionality to authorized administrators only via network segmentation
4. Implement multi-factor authentication for all administrative accounts with backup access
PATCHING:
1. Upgrade Chikitsa PMS to version 2.0.3 or later immediately
2. If upgrade is not immediately possible, apply vendor security patches when available
3. Test patches in non-production environment before deployment
COMPENSATING CONTROLS (if patching delayed):
1. Disable backup restoration functionality at the application level if not actively needed
2. Implement Web Application Firewall (WAF) rules to block suspicious backup file uploads (detect .php, .phtml, .php3 extensions in zip files)
3. Monitor file upload directories for unexpected PHP files using SIEM/EDR tools
4. Implement strict input validation on backup file uploads
5. Run backup restoration operations in isolated sandboxed environments
DETECTION RULES:
1. Alert on backup restoration API calls from non-administrative IP ranges
2. Monitor for PHP file creation in backup/restore directories
3. Track failed authentication attempts followed by successful backup restoration
4. Alert on execution of system commands from web server process (apache/nginx user)
5. Monitor for suspicious process spawning from PHP interpreter (cmd.exe, /bin/bash from httpd process)
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. حدد جميع نسخ نظام إدارة المرضى Chikitsa 2.0.2 في بيئتك وعزل الأنظمة المتأثرة عن شبكات الإنتاج إن أمكن
2. راجع سجلات الوصول لوظيفة استعادة النسخة الاحتياطية (عادة /admin/backup أو /restore endpoints) للأنشطة المريبة
3. قيد وظيفة استعادة النسخة الاحتياطية للمسؤولين المصرح لهم فقط عبر تقسيم الشبكة
4. طبق المصادقة متعددة العوامل لجميع حسابات المسؤولين التي لها حق الوصول للنسخ الاحتياطية
التصحيح:
1. قم بترقية نظام إدارة المرضى Chikitsa إلى الإصدار 2.0.3 أو أحدث فوراً
2. إذا لم يكن الترقية ممكنة على الفور، طبق تصحيحات الأمان من المورد عند توفرها
3. اختبر التصحيحات في بيئة غير الإنتاج قبل النشر
الضوابط البديلة (إذا تأخر التصحيح):
1. عطل وظيفة استعادة النسخة الاحتياطية على مستوى التطبيق إذا لم تكن مطلوبة بنشاط
2. طبق قواعد جدار حماية تطبيقات الويب (WAF) لحظر رفع ملفات النسخ الاحتياطية المريبة (كشف امتدادات .php و .phtml و .php3 في ملفات zip)
3. راقب دلائل رفع الملفات للملفات PHP غير المتوقعة باستخدام أدوات SIEM/EDR
4. طبق التحقق الصارم من صحة المدخلات على رفع ملفات النسخ الاحتياطية
5. قم بتشغيل عمليات استعادة النسخة الاحتياطية في بيئات معزولة
قواعد الكشف:
1. تنبيه على استدعاءات API استعادة النسخة الاحتياطية من نطاقات IP غير إدارية
2. راقب إنشاء ملفات PHP في دلائل النسخ الاحتياطية/الاستعادة
3. تتبع محاولات المصادقة الفاشلة متبوعة باستعادة نسخة احتياطية ناجحة
4. تنبيه على تنفيذ أوامر النظام من عملية خادم الويب (مستخدم apache/nginx)
5. راقب توليد العمليات المريبة من مترجم PHP (cmd.exe أو /bin/bash من عملية httpd)
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
A.5.1.1 - Information Security Policies and Procedures
A.6.1.1 - Access Control Policy
A.6.2.1 - User Registration and De-registration
A.6.2.2 - User Access Provisioning
A.7.1.1 - Cryptography Policy
A.8.1.1 - Audit Logging
A.8.2.1 - Protection of Log Information
A.9.1.1 - Malware Protection
A.10.1.1 - Vulnerability Management
🔵 SAMA CSF
Governance - Policy and Risk Management
Governance - Compliance and Audit
Protection - Access Control and Authentication
Protection - Data Protection and Privacy
Detection - Security Monitoring and Logging
Response - Incident Management
🟡 ISO 27001:2022
A.5.1.1 - Information security policies
A.6.1.1 - Access control policy
A.6.2.1 - User registration and access rights
A.8.1.1 - Audit logging
A.8.2.1 - Protection of log information
A.9.1.1 - Malware protection
A.10.1.1 - Information security incident management
A.12.2.1 - Restrictions on software installation
A.14.2.1 - Secure development policy
🟣 PCI DSS v4.0.1
Requirement 1 - Install and maintain firewall configuration
Requirement 2 - Do not use vendor-supplied defaults
Requirement 6 - Develop and maintain secure systems
Requirement 6.2 - Ensure security patches are installed
Requirement 8 - Assign unique ID to each person
Requirement 10 - Track and monitor access to network resources
🔗 References & Sources 4
🔗
https://github.com/sanskruti-technologies/chikitsa
disclosure@vulncheck.com
Product
🔗
https://sourceforge.net/projects/chikitsa/
disclosure@vulncheck.com
Product
🔗
https://www.chikitsa.io/
disclosure@vulncheck.com
Product
🔗
https://www.exploit-db.com/exploits/50572
disclosure@vulncheck.com
Exploit
VDB Entry
📦 Affected Products / CPE 1 entries
chikitsa:patient_management_system:2.0.2