| Titel | gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 Cross-Site Request Forgery |
|---|
| Beschreibung | The affected component is `application/config/config.php`, which disables the framework-level CSRF protection and the global XSS filter. Every `simpan()`, `set()`, `hapus()`, `kirim()`, `approve()`, and other state-changing endpoint in the project therefore accepts cross-origin POST submissions:
```php
// application/config/config.php
$config['csrf_protection'] = FALSE;
$config['csrf_token_name'] = 'csrf_test_name';
$config['csrf_cookie_name'] = 'csrf_cookie_name';
$config['csrf_expire'] = 7200;
...
$config['global_xss_filtering'] = FALSE;
```
Because the application keeps an authenticated session only by `ci_session` (no CSRF token, no SameSite attribute), an attacker can craft a page that auto-submits a POST form to any admin endpoint while a logged-in administrator is browsing the attacker's site. The endpoints exposed to CSRF include:
- `application/modules/admin/controllers/sistem.php::simpan()` — overwrite `dlmbg_setting` rows (XSS, salted MD5, base URL).
- `application/modules/admin/controllers/user.php::simpan()` — create/modify user accounts (privilege escalation to admin).
- `application/modules/admin/controllers/routing_pages.php::simpan()` — store XSS payloads and open redirects.
- `application/modules/admin/controllers/data_pasien.php::simpan()` — tamper with patient records.
- `application/modules/admin/controllers/data_buku_tamu.php::simpan()` / `::approve()` — inject stored XSS.
- `application/modules/admin/controllers/data_galeri.php::hapus()` — delete arbitrary gallery records.
- `application/modules/admin/controllers/data_perawat.php::simpan()` / `hapus()`.
- `application/modules/admin/controllers/data_dokter.php::simpan()` / `hapus()`.
|
|---|
| Quelle | ⚠️ https://github.com/gedelumbung/HospitalManagement/issues/6 |
|---|
| Benutzer | m1rr0r199411 (UID 100741) |
|---|
| Einreichung | 22.08.2026 12:21 (vor 28 Tagen) |
|---|
| Moderieren | 18.09.2026 10:50 (27 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 407444 [gedelumbung HospitalManagement bis c2d45543789a3887067d3915f69d44cfc2cf76a8 Cross Site Request Forgery] |
|---|
| Punkte | 20 |
|---|