提出 #946243: gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 Cross Site Scripting

The affected components are `application/modules/web/controllers/buku_tamu.php::kirim()` (unauthenticated entry), `application/modules/admin/views/buku_tamu/bg_home.php` / `bg_input.php` and `application/models/app_global_admin_model.php::generate_index_buku_tamu()`. The `kirim()` action inserts `$_POST['nama']`, `$_POST['email']` and `$_POST['pesan']` directly into `dlmbg_buku_tamu` without any sanitization:

```php
// application/modules/web/controllers/buku_tamu.php
function kirim()
{
$in['nama'] = $_POST['nama'];
$in['email'] = $_POST['email'];
$in['pesan'] = $_POST['pesan'];
$in['st'] = 0;
$this->db->insert("dlmbg_buku_tamu",$in);
$this->session->set_flashdata("hasil","Data anda telah terkirim, ...");
redirect("web/buku_tamu");
}
```

The admin render path echoes those columns raw. In `application/models/app_global_admin_model.php::generate_index_buku_tamu()` (lines 818-820):

```php
$hasil .= "<tr><td>".$i." </td><td>".$h->nama." </td><td>".$h->email." </td>
```

In `application/models/app_global_web.php::generate_index_buku_tamu()` (lines 117-128):

```php
<td>'.$h->nama.'</td>
...
<td>'.$h->email.'</td>
...
<td>'.$h->pesan.'</td>
```

The `bg_input.php` view echoes `$nama`, `$email` and `$pesan` inside `value="..."` and a `<textarea>` without escaping. The `'st' => 0` value means the entry starts as `unapproved`, but the approval flow (`admin/data_buku_tamu/approve/{id}/1`) only flips a flag without re-encoding the stored content. Therefore the XSS executes both in the admin listing (`bg_home.php`) and in the admin edit form (`bg_input.php`).

• ソース: ⚠️ https://github.com/gedelumbung/HospitalManagement/issues/13
• ユーザー: Chenshiyi (UID 100261)
• 送信: 2026年08月25日 15:33 (1 月 ago)
• モデレーション: 2026年09月29日 19:26 (1 month later)
• ステータス: 承諾済み
• VulDBエントリ: 411506 [gedelumbung HospitalManagement 迄 c2d45543789a3887067d3915f69d44cfc2cf76a8 Guest Book buku_tamu.php kirim nama/email/pesan クロスサイトスクリプティング]
• ポイント: 20