gedelumbung HospitalManagement CVE-2026-102845

Exploitation requires that the deployed instance runs with PHP error reporting/display enabled (a production-misconfiguration or default of this project) so that error output from index.php is returned in HTTP responses; an attacker then only needs to induce an error condition remotely. No authentication and no user interaction are required (PR:N/UI:N). The main limiting factors are the low real-world deployment footprint of this niche PHP hospital-management application and the fact that impact is confined to information disclosure (no integrity or availability effect); if the instance has display_errors disabled, the leak does not occur.

This is a genuine but low-severity issue whose signals are internally consistent. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates trivially reachable, unauthenticated, low-complexity remote access, but every impact metric except VC is None (VC:L only) - the flaw discloses information and nothing more. The vendor score of 6.9 is somewhat inflated for a confidentiality-only, low-magnitude leak; a base-metric reading lands closer to CVSS 3.1 ~5.3. SSVC-style framing: exploitation is 'proof-of-concept' (E:P in the vector, matching the publicly disclosed PoC), automatable-plausible (unauthenticated GET-level trigger), but technical impact is partial/low. There is no EPSS score and no CISA KEV listing, so there is no evidence of active or widespread exploitation - consistent with an obscure, niche product. Net: publicly available exploit code exists, but this is a high-CVSS-looking, low-real-risk information-disclosure issue, prioritized mainly as an information-leak hygiene fix rather than an urgent remediation.

An unauthenticated remote attacker sends requests to the application's index.php and triggers error conditions that the misconfigured error_reporting behavior surfaces directly in the HTTP response. The verbose errors reveal internal details such as file paths, stack traces, or database/SQL error text, which the attacker harvests for reconnaissance against the hospital-management app. A public proof-of-concept exists (disclosed in GitHub issue #11), lowering the effort required.