This vulnerability involves an unrestricted file upload flaw in the onetwothreeneth HospitalManagementSystem, specifically in the functions add_patient, add_physician, add_account, update_account, update_subaccount, edit_physician, and edit_patient within php/controller.php. An attacker can manipulate the 'img' parameter to upload arbitrary files remotely without any privileges or user interaction. The system operates on a rolling release basis, so no specific version numbers are provided. The project was notified early but has not issued a fix or response. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation allows an unauthenticated remote attacker to upload arbitrary files to the server, potentially leading to code execution or other malicious activities depending on the uploaded file's nature and server configuration. This can compromise the confidentiality, integrity, and availability of the affected system. The medium CVSS score reflects the significant but not critical impact due to the lack of required privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has not responded or issued a fix as of the published date. Until a patch is available, restrict file upload permissions, implement strict validation and sanitization of uploaded files, and consider additional protective controls such as web application firewalls to detect and block malicious upload attempts.