| Title | gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 Cross-Site Request Forgery |
|---|
| Description | The affected component is `application/config/config.php`, which disables the framework-level CSRF protection and the global XSS filter. Every `simpan()`, `set()`, `hapus()`, `kirim()`, `approve()`, and other state-changing endpoint in the project therefore accepts cross-origin POST submissions:
```php
// application/config/config.php
$config['csrf_protection'] = FALSE;
$config['csrf_token_name'] = 'csrf_test_name';
$config['csrf_cookie_name'] = 'csrf_cookie_name';
$config['csrf_expire'] = 7200;
...
$config['global_xss_filtering'] = FALSE;
```
Because the application keeps an authenticated session only by `ci_session` (no CSRF token, no SameSite attribute), an attacker can craft a page that auto-submits a POST form to any admin endpoint while a logged-in administrator is browsing the attacker's site. The endpoints exposed to CSRF include:
- `application/modules/admin/controllers/sistem.php::simpan()` — overwrite `dlmbg_setting` rows (XSS, salted MD5, base URL).
- `application/modules/admin/controllers/user.php::simpan()` — create/modify user accounts (privilege escalation to admin).
- `application/modules/admin/controllers/routing_pages.php::simpan()` — store XSS payloads and open redirects.
- `application/modules/admin/controllers/data_pasien.php::simpan()` — tamper with patient records.
- `application/modules/admin/controllers/data_buku_tamu.php::simpan()` / `::approve()` — inject stored XSS.
- `application/modules/admin/controllers/data_galeri.php::hapus()` — delete arbitrary gallery records.
- `application/modules/admin/controllers/data_perawat.php::simpan()` / `hapus()`.
- `application/modules/admin/controllers/data_dokter.php::simpan()` / `hapus()`.
|
|---|
| Source | ⚠️ https://github.com/gedelumbung/HospitalManagement/issues/6 |
|---|
| User | m1rr0r199411 (UID 100741) |
|---|
| Submission | 08/22/2026 12:21 (27 days ago) |
|---|
| Moderation | 09/18/2026 10:50 (27 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 407444 [gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8 cross-site request forgery] |
|---|
| Points | 20 |
|---|