Invia #1021801: gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 Open Redirect

The affected components are `application/modules/admin/controllers/routing_pages.php::simpan()` and `application/modules/web/controllers/web.php::pages()`. The `simpan()` action persists a user-controlled `url_route` column without any URL validation:

```php
// application/modules/admin/controllers/routing_pages.php (lines 86-101)
public function simpan()
{
...
if($tipe=="tambah")
{
$in['menu'] = $this->input->post("menu");
$in['url_route'] = $this->input->post("url_route");
$in['content'] = $this->input->post("content");
$in['posisi'] = $this->input->post("posisi");
$this->db->insert("dlmbg_menu",$in);
}
else if($tipe=="edit")
{
$in['menu'] = $this->input->post("menu");
$in['url_route'] = $this->input->post("url_route");
$in['content'] = $this->input->post("content");
$in['posisi'] = $this->input->post("posisi");
$this->db->update("dlmbg_menu",$in,$id);
}
...
}
```

`web/web.php::pages($id_param)` issues a CodeIgniter `redirect($h->url_route)` whenever the column is non-empty:

```php
// application/modules/web/controllers/web.php
function pages($id_param=0)
{
$where['id_menu'] = $id_param;
$get_data = $this->db->get_where("dlmbg_menu",$where);
if($get_data->num_rows()>0)
{
$h = $get_data->row();
if($h->url_route=="")
{
...
$this->load->view($GLOBALS['site_theme']."/front/bg_pages",$d);
...
}
else
{
redirect($h->url_route);
}
}
...
}
```

CodeIgniter's `redirect()` accepts absolute URLs (`http://`, `https://`, `//attacker.test`) when `allowed_protocols` permits them (the default includes both). An attacker who tricks an admin into visiting the menu link is redirected to an attacker-controlled origin, enabling phishing and OAuth-style account-takeover flows. Because the redirect uses the application's own host as the entry point, it bypasses origin-based anti-phishing heuristics that look for external links in emails.

• Fonte: ⚠️ https://github.com/gedelumbung/HospitalManagement/issues/17
• Utente: lixiang (UID 101908)
• Sottomissione: 09/10/2026 13:55 (14 giorni fa)
• Moderazione: 22/10/2026 21:33 (13 days later)
• Stato: Accettato
• Voce VulDB: 425390 [gedelumbung HospitalManagement fino a c2d45543789a3887067d3915f69d44cfc2cf76a8 URL Validation routing_pages.php simpan url_route Redirect]
• Punti: 20