| عنوان | gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 Cross Site Scripting |
|---|
| الوصف | The affected components are `application/modules/admin/controllers/routing_pages.php::simpan()`, the public-facing view `application/views/black-inverse/front/bg_pages.php`, and the front controller `application/modules/web/controllers/web.php::pages()`. The `simpan()` action saves the `content` field raw (it is loaded through a CKEditor `<textarea>`):
```php
// application/modules/admin/controllers/routing_pages.php (lines 86-101)
public function simpan()
{
if($this->session->userdata("logged_in")!="" && $this->session->userdata("level")=="admin")
{
$tipe = $this->input->post("tipe");
$id['id_menu'] = $this->input->post("id_param");
if($tipe=="tambah")
{
$in['menu'] = $this->input->post("menu");
$in['url_route'] = $this->input->post("url_route");
$in['content'] = $this->input->post("content");
$in['posisi'] = $this->input->post("posisi");
$this->db->insert("dlmbg_menu",$in);
}
else if($tipe=="edit")
{
$in['menu'] = $this->input->post("menu");
$in['url_route'] = $this->input->post("url_route");
$in['content'] = $this->input->post("content");
$in['posisi'] = $this->input->post("posisi");
$this->db->update("dlmbg_menu",$in,$id);
}
redirect("admin/routing_pages");
}
...
}
```
The `web/web.php::pages($id_param)` action loads the row and, when `url_route` is empty, hands `$content` straight to the view:
```php
// application/modules/web/controllers/web.php
function pages($id_param=0)
{
$where['id_menu'] = $id_param;
$get_data = $this->db->get_where("dlmbg_menu",$where);
if($get_data->num_rows()>0)
{
$h = $get_data->row();
if($h->url_route=="")
{
$d['judul'] = $h->menu;
$d['content'] = $h->content;
...
$this->load->view($GLOBALS['site_theme']."/front/bg_pages",$d);
...
}
...
}
...
}
```
The view `application/views/black-inverse/front/bg_pages.php` renders `$content` raw:
```php
<section class="post">
<div>
<h2><?php echo $judul; ?></h2>
<?php echo $content; ?>
</div>
<div class="cl"> </div>
</section>
```
The `$menu` column is also echoed raw inside `generate_index_menu()` (admin) and the front header. Because `global_xss_filtering` is disabled, the payload is stored verbatim and executes in any visitor's browser.
|
|---|
| المصدر | ⚠️ https://github.com/gedelumbung/HospitalManagement/issues/16 |
|---|
| المستخدم | lixiang (UID 101908) |
|---|
| ارسال | 09/10/2026 01:54 PM (14 أيام منذ) |
|---|
| الاعتدال | 22/10/2026 09:33 PM (13 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 425389 [gedelumbung HospitalManagement حتى c2d45543789a3887067d3915f69d44cfc2cf76a8 Admin Routing Page routing_pages.php simpan content البرمجة عبر المواقع] |
|---|
| النقاط | 20 |
|---|