| Title | gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 SQL Injection |
|---|
| Description | The affected components are `application/modules/admin/controllers/ruang.php::set()` which writes `$_POST['cari']` into the session and `application/models/app_global_admin_model.php::generate_index_ruang()` which interpolates that session value into a hand-built `SELECT` query:
```php
// application/modules/admin/controllers/ruang.php (lines 199-203)
public function set()
{
if($this->session->userdata("logged_in")!="" && $this->session->userdata("level")=="admin")
{
$set['cari'] = $_POST['cari'];
$this->session->set_userdata($set);
redirect("admin/ruang");
}
...
}
```
```php
// application/models/app_global_admin_model.php (lines 202-219)
public function generate_index_ruang($limit,$offset,$cari)
{
$hasil="";
$search['nama_ruang'] = $cari;
$tot_hal = $this->db->like($search)->get("dlmbg_ruang");
...
$w = $this->db->query("select a.nama_ruang, b.kategori_ruang, a.status_ruangan, a.id_ruang, ... from dlmbg_ruang a
left join dlmbg_kategori_ruang b on a.id_kategori_ruang=b.id_kategori_ruang where nama_ruang like '%".$search['nama_ruang']."%' LIMIT ".$offset.",".$limit."");
...
}
```
The pagination total is computed through Active Record (`$this->db->like($search)->get(...)`) which is escaped, but the page query uses the unsanitized session value directly. Because no validation or `escape_like_str` is applied, the page query is fully injectable. The exact same root cause exists in `perawat/ruang`, `perawat/data_pasien`, and the direktur module, all sharing `generate_index_*` helpers in `app_global_admin_model.php`.
|
|---|
| Source | ⚠️ https://github.com/gedelumbung/HospitalManagement/issues/5 |
|---|
| User | Jameszhan783 (UID 100727) |
|---|
| Submission | 08/21/2026 16:22 (27 days ago) |
|---|
| Moderation | 09/17/2026 19:20 (27 days later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 404471 [gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8 app_global_admin_model.php generate_index_pasien cari sql injection] |
|---|
| Points | 0 |
|---|