This vulnerability in rickxy Hospital Management System arises from insufficient validation of the ad_dpic parameter in the backend admin account management PHP script, allowing an attacker to upload arbitrary files remotely without restrictions. The affected version is identified by a specific commit hash, but due to the rolling release nature of the product, exact affected or fixed versions are unclear. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity with network attack vector, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation allows remote attackers to upload arbitrary files to the server, potentially leading to unauthorized code execution or system compromise depending on the uploaded file and server configuration. The medium CVSS score reflects moderate impact with limited confidentiality, integrity, and availability consequences. No known exploits in the wild have been reported yet, but public exploit code is available.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor vendor communications for updates. In the meantime, restricting file upload permissions, validating and sanitizing file inputs, and applying web application firewall rules to block malicious upload attempts may help mitigate risk.