CVE-2026-6602 Details
Description
A vulnerability was found in rickxy Hospital Management System up to 88a4290d957dc5bdde8a56e5ad451ad14f7f90f4. Affected is an unknown function of the file /backend/admin/his_admin_account.php. The manipulation of the argument ad_dpic results in unrestricted upload. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable.
A critical arbitrary file upload vulnerability has been identified in rickxy Hospital Management System version 1.0, specifically within the file '/backend/admin/his_admin_account.php'. This vulnerability allows unauthenticated attackers to upload malicious PHP files, such as web shells, by exploiting the 'ad_dpic' parameter. The uploaded files can be executed remotely, leading to unauthorized access and control over the server. The vulnerability arises from inadequate validation of file extensions and MIME types, coupled with a lack of session validation on the affected endpoint.
It is recommended to implement strict validation of uploaded files, ensuring only safe image types are accepted. Additionally, verify the actual content of uploaded files using PHP functions like 'getimagesize()' or 'finfo_file'. Restrict execution permissions for PHP files in the upload directory and rename uploaded files to prevent easy access to the original file names.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 20, 2026CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/freeloader9527/cve/issues/2 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://vuldb.com/submit/792092 | [email protected] | ExploitTechnical Description |
| https://vuldb.com/vuln/358237 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/vuln/358237/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rickxy Hospital Management System | 1.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 20, 2026 | New CVE Received | [email protected] |