| 标题 | gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 SQL Injection |
|---|
| 描述 | The affected components are `application/modules/admin/controllers/ruang.php::set()` which writes `$_POST['cari']` into the session and `application/models/app_global_admin_model.php::generate_index_ruang()` which interpolates that session value into a hand-built `SELECT` query:
```php
// application/modules/admin/controllers/ruang.php (lines 199-203)
public function set()
{
if($this->session->userdata("logged_in")!="" && $this->session->userdata("level")=="admin")
{
$set['cari'] = $_POST['cari'];
$this->session->set_userdata($set);
redirect("admin/ruang");
}
...
}
```
```php
// application/models/app_global_admin_model.php (lines 202-219)
public function generate_index_ruang($limit,$offset,$cari)
{
$hasil="";
$search['nama_ruang'] = $cari;
$tot_hal = $this->db->like($search)->get("dlmbg_ruang");
...
$w = $this->db->query("select a.nama_ruang, b.kategori_ruang, a.status_ruangan, a.id_ruang, ... from dlmbg_ruang a
left join dlmbg_kategori_ruang b on a.id_kategori_ruang=b.id_kategori_ruang where nama_ruang like '%".$search['nama_ruang']."%' LIMIT ".$offset.",".$limit."");
...
}
```
The pagination total is computed through Active Record (`$this->db->like($search)->get(...)`) which is escaped, but the page query uses the unsanitized session value directly. Because no validation or `escape_like_str` is applied, the page query is fully injectable. The exact same root cause exists in `perawat/ruang`, `perawat/data_pasien`, and the direktur module, all sharing `generate_index_*` helpers in `app_global_admin_model.php`.
|
|---|
| 来源 | ⚠️ https://github.com/gedelumbung/HospitalManagement/issues/5 |
|---|
| 用户 | Jameszhan783 (UID 100727) |
|---|
| 提交 | 2026-08-21 16時22分 (2 月前) |
|---|
| 管理 | 2026-09-17 19時20分 (27 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 404471 [gedelumbung HospitalManagement 直到 c2d45543789a3887067d3915f69d44cfc2cf76a8 app_global_admin_model.php generate_index_pasien cari SQL注入] |
|---|
| 积分 | 0 |
|---|