| 标题 | gedelumbung HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8 Cross-Site Request Forgery |
|---|
| 描述 | The affected component is `application/config/config.php`, which disables the framework-level CSRF protection and the global XSS filter. Every `simpan()`, `set()`, `hapus()`, `kirim()`, `approve()`, and other state-changing endpoint in the project therefore accepts cross-origin POST submissions:
```php
// application/config/config.php
$config['csrf_protection'] = FALSE;
$config['csrf_token_name'] = 'csrf_test_name';
$config['csrf_cookie_name'] = 'csrf_cookie_name';
$config['csrf_expire'] = 7200;
...
$config['global_xss_filtering'] = FALSE;
```
Because the application keeps an authenticated session only by `ci_session` (no CSRF token, no SameSite attribute), an attacker can craft a page that auto-submits a POST form to any admin endpoint while a logged-in administrator is browsing the attacker's site. The endpoints exposed to CSRF include:
- `application/modules/admin/controllers/sistem.php::simpan()` — overwrite `dlmbg_setting` rows (XSS, salted MD5, base URL).
- `application/modules/admin/controllers/user.php::simpan()` — create/modify user accounts (privilege escalation to admin).
- `application/modules/admin/controllers/routing_pages.php::simpan()` — store XSS payloads and open redirects.
- `application/modules/admin/controllers/data_pasien.php::simpan()` — tamper with patient records.
- `application/modules/admin/controllers/data_buku_tamu.php::simpan()` / `::approve()` — inject stored XSS.
- `application/modules/admin/controllers/data_galeri.php::hapus()` — delete arbitrary gallery records.
- `application/modules/admin/controllers/data_perawat.php::simpan()` / `hapus()`.
- `application/modules/admin/controllers/data_dokter.php::simpan()` / `hapus()`.
|
|---|
| 来源 | ⚠️ https://github.com/gedelumbung/HospitalManagement/issues/6 |
|---|
| 用户 | m1rr0r199411 (UID 100741) |
|---|
| 提交 | 2026-08-22 12時21分 (27 日前) |
|---|
| 管理 | 2026-09-18 10時50分 (27 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 407444 [gedelumbung HospitalManagement 直到 c2d45543789a3887067d3915f69d44cfc2cf76a8 跨网站请求伪造] |
|---|
| 积分 | 20 |
|---|