An attacker can exploit the his_admin_account.php file in rickxy Hospital Management System by sending a crafted request to the ad_dpic argument, allowing the upload of any file type without restriction. This deficiency permits a malicious user to place executable code on the server, resulting in remote code execution. The flaw combines an input validation weakness (unrestricted upload, CWE‑434) with inadequate access controls (CWE‑284), making it possible to compromise the application even from a remote location.

The vulnerability exists in all instances of rickxy Hospital Management System registered as up to the commit 88a4290d957dc5bdde8a56e5ad451ad14f7f90f4. Because the product follows a rolling release distribution model, specific safe version numbers after remediation are not published, so any current release should be considered potentially vulnerable until an official fix is announced.

The CVSS score of 6.9 indicates a moderate severity vulnerability. EPSS is not available and the issue is not yet listed in CISA’s KEV catalog, but a public exploit demonstrates that remote execution is achievable. The attack vector is remote via the web interface, and the potential impact includes full compromise of the application’s confidentiality, integrity, and availability.