| Название | gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 SQL Injection |
|---|
| Описание | The affected components are `application/modules/admin/controllers/data_pasien.php::set()` which writes `$_POST['cari']` directly into the user session, and `application/models/app_global_admin_model.php::generate_index_pasien()` which concatenates the session value into the page query:
```php
// application/modules/admin/controllers/data_pasien.php (lines 215-219)
public function set()
{
if($this->session->userdata("logged_in")!="" && $this->session->userdata("level")=="admin")
{
$set['cari'] = $_POST['cari'];
$this->session->set_userdata($set);
redirect("admin/data_pasien");
}
...
}
```
```php
// application/models/app_global_admin_model.php (lines 260-277)
public function generate_index_pasien($limit,$offset,$cari)
{
$hasil="";
$search['nama_pasien'] = $cari;
$tot_hal = $this->db->like($search)->get("dlmbg_pasien");
...
$w = $this->db->query("select a.id_pasien, a.nama_pasien, a.tgl_masuk, b.nama_ruang, c.nama_dokter from dlmbg_pasien a left join dlmbg_ruang b on
a.id_ruang=b.id_ruang left join dlmbg_dokter c on a.id_dokter=c.id_dokter where nama_pasien like '%".$search['nama_pasien']."%' LIMIT ".$offset.",".$limit."");
...
}
```
The pagination total is computed through `$this->db->like($search)->get("dlmbg_pasien")` (which escapes via Active Record), but the actual page query is hand-built and concatenated. Because the controller performs no validation or escaping, any authenticated admin can submit `cari=' UNION SELECT username,password,1,2,3 FROM dlmbg_user -- ` and the page query will return arbitrary rows. Combined with `db_debug=TRUE`, error-based extraction is also trivial. The same SQL fragment is reused in the `pagination` calculation when the LIKE is taken from the raw session value.
|
|---|
| Источник | ⚠️ https://github.com/gedelumbung/HospitalManagement/issues/4 |
|---|
| Пользователь | kaizhi_shawn (UID 100620) |
|---|
| Представление | 17.08.2026 16:45 (30 дни назад) |
|---|
| Модерация | 15.09.2026 20:43 (29 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 404471 [gedelumbung HospitalManagement до c2d45543789a3887067d3915f69d44cfc2cf76a8 app_global_admin_model.php generate_index_pasien cari SQL-инъекция] |
|---|
| Баллы | 20 |
|---|