CVE-2021-47757

HighPublic PoC

Published: 15 January 2026

Published

15 January 2026

Modified

23 January 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0083 74.7th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-47757 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Chikitsa Patient Management System. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-3 (Malicious Code Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Validates the content and structure of uploaded backup ZIP files to prevent inclusion of malicious PHP shells that enable remote code execution.

SI-3 Malicious Code Protection good match

preventdetect

Deploys malicious code protection mechanisms to scan and block ZIP files containing PHP shells during upload or extraction in the backup restoration process.

AC-6 Least Privilege partial match

prevent

Enforces least privilege to restrict backup restoration functionality to only necessary high-privilege accounts, mitigating exploitation by low-privilege authenticated attackers.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

The vulnerability enables exploitation of a public-facing web application (T1190) via authenticated upload of a malicious ZIP containing a PHP web shell (T1100), directly facilitating remote code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability in the backup restoration functionality. Authenticated attackers can upload a modified backup zip file with a malicious PHP shell to execute arbitrary system commands on the server.

Deeper analysisAI

CVE-2021-47757 is an authenticated remote code execution vulnerability in Chikitsa Patient Management System version 2.0.2. The issue affects the backup restoration functionality, allowing attackers to upload a modified backup ZIP file containing a malicious PHP shell.

Authenticated attackers with low privileges can exploit this vulnerability over the network with low attack complexity and no user interaction. Exploitation enables execution of arbitrary system commands on the server, resulting in high impacts to confidentiality, integrity, and availability, as reflected in the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-434.

References point to the project's GitHub repository at https://github.com/sanskruti-technologies/chikitsa, SourceForge page at https://sourceforge.net/projects/chikitsa/, official site at https://www.chikitsa.io/, and an Exploit-DB entry at https://www.exploit-db.com/exploits/50572. No specific mitigation or patch details are detailed in the provided information.