Patient-to-Administrator escalation via missing role checks

Privilege escalation in PHPGurukul Hospital Management System 4.0 allows remote authenticated users to access doctor and admin panels. The doctor and admin dashboard routes accept a patient session without verifying that the session belongs to the required role. A self-registered patient account is sufficient to read sensitive records and invoke privileged administrative functions, but public evidence does not demonstrate arbitrary code execution.