gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8 Password Change password.php simpan kode_user/username improper authentication

Summaryinfo

A vulnerability has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8 and classified as critical. Impacted is the function application/modules/global/controllers/password.php::simpan/application/modules/global/controllers/profil.php::simpan of the file application/modules/global/controllers/password.php of the component Password Change Handler. Performing a manipulation of the argument kode_user/username results in improper authentication. This vulnerability is known as CVE-2026-93532. Remote exploitation of the attack is possible. Furthermore, an exploit is available. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Detailsinfo

A vulnerability was found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. It has been classified as critical. This affects the function application/modules/global/controllers/password.php::simpan/application/modules/global/controllers/profil.php::simpan of the file application/modules/global/controllers/password.php of the component Password Change Handler. The manipulation of the argument kode_user/username with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-93532. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details and a public exploit are known.

The exploit is shared for download at github.com. It is declared as proof-of-concept. The project was informed of the problem early through an issue report but has not responded yet. By approaching the search of inurl:application/modules/global/controllers/password.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• gedelumbung

Name

• HospitalManagement

Version

• c2d45543789a3887067d3915f69d44cfc2cf76a8

Website

• Product: https://github.com/gedelumbung/HospitalManagement/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #943245: gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 Improper Authentication (by m1rr0r199411)

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion