| Titel | gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 Open Redirect |
|---|
| Beschreibung | The affected components are `application/modules/admin/controllers/routing_pages.php::simpan()` and `application/modules/web/controllers/web.php::pages()`. The `simpan()` action persists a user-controlled `url_route` column without any URL validation:
```php
// application/modules/admin/controllers/routing_pages.php (lines 86-101)
public function simpan()
{
...
if($tipe=="tambah")
{
$in['menu'] = $this->input->post("menu");
$in['url_route'] = $this->input->post("url_route");
$in['content'] = $this->input->post("content");
$in['posisi'] = $this->input->post("posisi");
$this->db->insert("dlmbg_menu",$in);
}
else if($tipe=="edit")
{
$in['menu'] = $this->input->post("menu");
$in['url_route'] = $this->input->post("url_route");
$in['content'] = $this->input->post("content");
$in['posisi'] = $this->input->post("posisi");
$this->db->update("dlmbg_menu",$in,$id);
}
...
}
```
`web/web.php::pages($id_param)` issues a CodeIgniter `redirect($h->url_route)` whenever the column is non-empty:
```php
// application/modules/web/controllers/web.php
function pages($id_param=0)
{
$where['id_menu'] = $id_param;
$get_data = $this->db->get_where("dlmbg_menu",$where);
if($get_data->num_rows()>0)
{
$h = $get_data->row();
if($h->url_route=="")
{
...
$this->load->view($GLOBALS['site_theme']."/front/bg_pages",$d);
...
}
else
{
redirect($h->url_route);
}
}
...
}
```
CodeIgniter's `redirect()` accepts absolute URLs (`http://`, `https://`, `//attacker.test`) when `allowed_protocols` permits them (the default includes both). An attacker who tricks an admin into visiting the menu link is redirected to an attacker-controlled origin, enabling phishing and OAuth-style account-takeover flows. Because the redirect uses the application's own host as the entry point, it bypasses origin-based anti-phishing heuristics that look for external links in emails.
|
|---|
| Quelle | ⚠️ https://github.com/gedelumbung/HospitalManagement/issues/17 |
|---|
| Benutzer | lixiang (UID 101908) |
|---|
| Einreichung | 09.10.2026 13:55 (vor 14 Tagen) |
|---|
| Moderieren | 22.10.2026 21:33 (13 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 425390 [gedelumbung HospitalManagement bis c2d45543789a3887067d3915f69d44cfc2cf76a8 URL Validation routing_pages.php simpan url_route Redirect] |
|---|
| Punkte | 20 |
|---|