提交 #1021799: gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 Cross Site Scripting

The affected components are `application/modules/admin/controllers/sistem.php::simpan()`, `application/modules/admin/views/sistem/bg_input.php`, `application/models/app_load_config_model.php::__construct()`, and `application/modules/admin/views/bg_header.php`. The `simpan()` action persists user input without escaping on every save:

```php
// application/modules/admin/controllers/sistem.php (lines 65-72)
public function simpan()
{
if($this->session->userdata("logged_in")!="" && $this->session->userdata("level")=="admin")
{
$tipe = $this->input->post("tipe");
$id['id_setting'] = $this->input->post("id_param");
$in['tipe'] = $this->input->post("tipe");
$in['title'] = $this->input->post("title");
$in['content_setting'] = strip_tags($this->input->post("content_setting"));
$this->db->update("dlmbg_setting",$in,$id);
redirect("admin/sistem");
}
...
}
```

`$in['title']` is saved without escaping or `strip_tags`. The same row's `content_setting` value is loaded back into `$GLOBALS[$d->tipe]` by `app_load_config_model`:

```php
// application/models/app_load_config_model.php
public function __construct()
{
$dt = $this->db->get("dlmbg_setting");
foreach($dt->result() as $d)
{
$GLOBALS[$d->tipe] = $d->content_setting;
}
}
```

The model output `generate_index_sistem()` echoes `$h->title` raw:

```php
// application/models/app_global_admin_model.php (line 189)
$hasil .= "<td>".$h->title."</td>
```

And `bg_header.php` echoes `$GLOBALS['site_title']` and `$GLOBALS['site_quotes']` raw inside the `<title>` and the H1:

```php
// application/modules/admin/views/bg_header.php (line 11)
<title><?php echo $GLOBALS['site_title'].' - '.$GLOBALS['site_quotes']; ?></title>
```

The same `$GLOBALS['site_title']` value is rendered by every admin page because every page includes `bg_header.php`. The `content_setting` payload is partially mitigated by `strip_tags`, but the `title` field is not, and `content_setting` itself can be smuggled past `strip_tags` using NULL-byte / malformed-tag tricks in older PHP versions, so both sinks are vulnerable.

• 来源: ⚠️ https://github.com/gedelumbung/HospitalManagement/issues/15
• 用户: lixiang (UID 101908)
• 提交: 2026-10-09 13時54分 (14 日前)
• 管理: 2026-10-22 21時33分 (13 days later)
• 状态: 已接受
• VulDB条目: 425388 [gedelumbung HospitalManagement 直到 c2d45543789a3887067d3915f69d44cfc2cf76a8 Settings sistem.php sistem.php::simpan title 跨网站脚本]
• 积分: 20