| 标题 | gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 SQL Injection |
|---|
| 描述 | The affected components are `application/modules/admin/controllers/data_pasien.php::set()` which writes `$_POST['cari']` directly into the user session, and `application/models/app_global_admin_model.php::generate_index_pasien()` which concatenates the session value into the page query:
```php
// application/modules/admin/controllers/data_pasien.php (lines 215-219)
public function set()
{
if($this->session->userdata("logged_in")!="" && $this->session->userdata("level")=="admin")
{
$set['cari'] = $_POST['cari'];
$this->session->set_userdata($set);
redirect("admin/data_pasien");
}
...
}
```
```php
// application/models/app_global_admin_model.php (lines 260-277)
public function generate_index_pasien($limit,$offset,$cari)
{
$hasil="";
$search['nama_pasien'] = $cari;
$tot_hal = $this->db->like($search)->get("dlmbg_pasien");
...
$w = $this->db->query("select a.id_pasien, a.nama_pasien, a.tgl_masuk, b.nama_ruang, c.nama_dokter from dlmbg_pasien a left join dlmbg_ruang b on
a.id_ruang=b.id_ruang left join dlmbg_dokter c on a.id_dokter=c.id_dokter where nama_pasien like '%".$search['nama_pasien']."%' LIMIT ".$offset.",".$limit."");
...
}
```
The pagination total is computed through `$this->db->like($search)->get("dlmbg_pasien")` (which escapes via Active Record), but the actual page query is hand-built and concatenated. Because the controller performs no validation or escaping, any authenticated admin can submit `cari=' UNION SELECT username,password,1,2,3 FROM dlmbg_user -- ` and the page query will return arbitrary rows. Combined with `db_debug=TRUE`, error-based extraction is also trivial. The same SQL fragment is reused in the `pagination` calculation when the LIKE is taken from the raw session value.
|
|---|
| 来源 | ⚠️ https://github.com/gedelumbung/HospitalManagement/issues/4 |
|---|
| 用户 | kaizhi_shawn (UID 100620) |
|---|
| 提交 | 2026-08-17 16時45分 (1 月前) |
|---|
| 管理 | 2026-09-15 20時43分 (29 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 404471 [gedelumbung HospitalManagement 直到 c2d45543789a3887067d3915f69d44cfc2cf76a8 app_global_admin_model.php generate_index_pasien cari SQL注入] |
|---|
| 积分 | 20 |
|---|