Gửi #1021800: gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 Cross Site Scripting

The affected components are `application/modules/admin/controllers/routing_pages.php::simpan()`, the public-facing view `application/views/black-inverse/front/bg_pages.php`, and the front controller `application/modules/web/controllers/web.php::pages()`. The `simpan()` action saves the `content` field raw (it is loaded through a CKEditor `<textarea>`):

```php
// application/modules/admin/controllers/routing_pages.php (lines 86-101)
public function simpan()
{
if($this->session->userdata("logged_in")!="" && $this->session->userdata("level")=="admin")
{
$tipe = $this->input->post("tipe");
$id['id_menu'] = $this->input->post("id_param");
if($tipe=="tambah")
{
$in['menu'] = $this->input->post("menu");
$in['url_route'] = $this->input->post("url_route");
$in['content'] = $this->input->post("content");
$in['posisi'] = $this->input->post("posisi");
$this->db->insert("dlmbg_menu",$in);
}
else if($tipe=="edit")
{
$in['menu'] = $this->input->post("menu");
$in['url_route'] = $this->input->post("url_route");
$in['content'] = $this->input->post("content");
$in['posisi'] = $this->input->post("posisi");
$this->db->update("dlmbg_menu",$in,$id);
}
redirect("admin/routing_pages");
}
...
}
```

The `web/web.php::pages($id_param)` action loads the row and, when `url_route` is empty, hands `$content` straight to the view:

```php
// application/modules/web/controllers/web.php
function pages($id_param=0)
{
$where['id_menu'] = $id_param;
$get_data = $this->db->get_where("dlmbg_menu",$where);
if($get_data->num_rows()>0)
{
$h = $get_data->row();
if($h->url_route=="")
{
$d['judul'] = $h->menu;
$d['content'] = $h->content;
...
$this->load->view($GLOBALS['site_theme']."/front/bg_pages",$d);
...
}
...
}
...
}
```

The view `application/views/black-inverse/front/bg_pages.php` renders `$content` raw:

```php
<section class="post">
<div>
<h2><?php echo $judul; ?></h2>
<?php echo $content; ?>
</div>
<div class="cl">&nbsp;</div>
</section>
```

The `$menu` column is also echoed raw inside `generate_index_menu()` (admin) and the front header. Because `global_xss_filtering` is disabled, the payload is stored verbatim and executes in any visitor's browser.

• Nguồn: ⚠️ https://github.com/gedelumbung/HospitalManagement/issues/16
• Người dùng: lixiang (UID 101908)
• Đệ trình: 09/10/2026 13:54 (cách đây 14 ngày)
• Kiểm duyệt: 22/10/2026 21:33 (13 days later)
• Trạng thái: được chấp nhận
• Mục VulDB: 425389 [gedelumbung HospitalManagement đến c2d45543789a3887067d3915f69d44cfc2cf76a8 Admin Routing Page routing_pages.php simpan content Tập lệnh chéo trang]
• điểm: 20