HospitalManagement CVE-2026-115537

Exploitation targets the 'simpan' function in application/modules/admin/controllers/routing_pages.php via manipulation of the url_route argument, producing an open redirect. No authentication is required (PR:N), but the attack is NOT fully unattended: it requires passive user interaction (UI:P) - a victim must click or follow the attacker-crafted link for the redirect to fire. The practical limiting factors are therefore the need for victim interaction and the requirement to reach the vulnerable admin routing endpoint; impact is confined to redirecting the victim's browser (low integrity), with no direct confidentiality or availability consequence. No non-default configuration is stated as necessary in the available sources.

This is a CWE-601 open redirect in the gedelumbung HospitalManagement application, rated CVSS 4.0 base 5.3 (medium). The supplied vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N is internally consistent with an open redirect: network-reachable (AV:N), low attack complexity (AC:L), no privileges (PR:N), but it requires passive user interaction (UI:P) - a victim must follow an attacker-supplied link - and the only impact is low integrity (VI:L) via the redirect, with no confidentiality or availability impact. The vuln.today Decision label is 'this_month', not act_now or emergency, which matches the modest technical impact. There is no CISA KEV listing, so this is not confirmed as actively exploited; no EPSS score was provided in the input, so exploitation probability cannot be quantified here. A public PoC reference exists (a GitHub issue), but it is not verified as working exploit code; the CVE text's claim that 'the exploit has been made available to the public' should be read against that caveat. Net assessment: a real but low-to-medium priority issue - the impact ceiling is phishing/redirect abuse rather than code execution or data loss, and the UI:P requirement plus the niche product footprint further limit real-world urgency. The affected-version picture is a genuine gap: the vendor uses a rolling release, so no vulnerable or fixed version numbers are available, and the project has not responded to the issue report.

An attacker crafts a URL to the HospitalManagement routing_pages.php 'simpan' handler with a manipulated url_route parameter pointing to an attacker-controlled domain, then delivers that link to a victim via phishing email or a malicious page. When the victim clicks it, the application redirects their browser to the attacker's site, which can be used for credential-harvesting phishing or malware delivery while appearing to originate from the trusted hospital application. A public PoC reference exists (GitHub issue #17); it is not verified as working exploit code.