| 제목 | gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 SQL Injection |
|---|
| 설명 | The affected components are `application/modules/admin/controllers/ruang.php::set()` which writes `$_POST['cari']` into the session and `application/models/app_global_admin_model.php::generate_index_ruang()` which interpolates that session value into a hand-built `SELECT` query:
```php
// application/modules/admin/controllers/ruang.php (lines 199-203)
public function set()
{
if($this->session->userdata("logged_in")!="" && $this->session->userdata("level")=="admin")
{
$set['cari'] = $_POST['cari'];
$this->session->set_userdata($set);
redirect("admin/ruang");
}
...
}
```
```php
// application/models/app_global_admin_model.php (lines 202-219)
public function generate_index_ruang($limit,$offset,$cari)
{
$hasil="";
$search['nama_ruang'] = $cari;
$tot_hal = $this->db->like($search)->get("dlmbg_ruang");
...
$w = $this->db->query("select a.nama_ruang, b.kategori_ruang, a.status_ruangan, a.id_ruang, ... from dlmbg_ruang a
left join dlmbg_kategori_ruang b on a.id_kategori_ruang=b.id_kategori_ruang where nama_ruang like '%".$search['nama_ruang']."%' LIMIT ".$offset.",".$limit."");
...
}
```
The pagination total is computed through Active Record (`$this->db->like($search)->get(...)`) which is escaped, but the page query uses the unsanitized session value directly. Because no validation or `escape_like_str` is applied, the page query is fully injectable. The exact same root cause exists in `perawat/ruang`, `perawat/data_pasien`, and the direktur module, all sharing `generate_index_*` helpers in `app_global_admin_model.php`.
|
|---|
| 원천 | ⚠️ https://github.com/gedelumbung/HospitalManagement/issues/5 |
|---|
| 사용자 | Jameszhan783 (UID 100727) |
|---|
| 제출 | 2026. 08. 21. PM 04:22 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 17. PM 07:20 (27 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 404471 [gedelumbung HospitalManagement 까지 c2d45543789a3887067d3915f69d44cfc2cf76a8 app_global_admin_model.php generate_index_pasien cari SQL 주입] |
|---|
| 포인트들 | 0 |
|---|