| शीर्षक | gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 Cross Site Scripting |
|---|
| विवरण | The affected components are `application/modules/admin/controllers/sistem.php::simpan()`, `application/modules/admin/views/sistem/bg_input.php`, `application/models/app_load_config_model.php::__construct()`, and `application/modules/admin/views/bg_header.php`. The `simpan()` action persists user input without escaping on every save:
```php
// application/modules/admin/controllers/sistem.php (lines 65-72)
public function simpan()
{
if($this->session->userdata("logged_in")!="" && $this->session->userdata("level")=="admin")
{
$tipe = $this->input->post("tipe");
$id['id_setting'] = $this->input->post("id_param");
$in['tipe'] = $this->input->post("tipe");
$in['title'] = $this->input->post("title");
$in['content_setting'] = strip_tags($this->input->post("content_setting"));
$this->db->update("dlmbg_setting",$in,$id);
redirect("admin/sistem");
}
...
}
```
`$in['title']` is saved without escaping or `strip_tags`. The same row's `content_setting` value is loaded back into `$GLOBALS[$d->tipe]` by `app_load_config_model`:
```php
// application/models/app_load_config_model.php
public function __construct()
{
$dt = $this->db->get("dlmbg_setting");
foreach($dt->result() as $d)
{
$GLOBALS[$d->tipe] = $d->content_setting;
}
}
```
The model output `generate_index_sistem()` echoes `$h->title` raw:
```php
// application/models/app_global_admin_model.php (line 189)
$hasil .= "<td>".$h->title."</td>
```
And `bg_header.php` echoes `$GLOBALS['site_title']` and `$GLOBALS['site_quotes']` raw inside the `<title>` and the H1:
```php
// application/modules/admin/views/bg_header.php (line 11)
<title><?php echo $GLOBALS['site_title'].' - '.$GLOBALS['site_quotes']; ?></title>
```
The same `$GLOBALS['site_title']` value is rendered by every admin page because every page includes `bg_header.php`. The `content_setting` payload is partially mitigated by `strip_tags`, but the `title` field is not, and `content_setting` itself can be smuggled past `strip_tags` using NULL-byte / malformed-tag tricks in older PHP versions, so both sinks are vulnerable.
|
|---|
| स्रोत | ⚠️ https://github.com/gedelumbung/HospitalManagement/issues/15 |
|---|
| उपयोगकर्ता | lixiang (UID 101908) |
|---|
| सबमिशन | 09/10/2026 01:54 PM (14 दिन पहले) |
|---|
| संयम | 22/10/2026 09:33 PM (13 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 425388 [gedelumbung HospitalManagement तक c2d45543789a3887067d3915f69d44cfc2cf76a8 Settings sistem.php sistem.php::simpan title क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 20 |
|---|