HospitalManagement EUVD-2026-89570

Requires an authenticated high-privilege session (CVSS PR:H) to reach the admin module's Configuration Handler - specifically the simpan function in application/modules/admin/controllers/sistem.php. The attacker manipulates the tipe, title, and content_setting arguments to perform configuration writes without proper authorization checks. Limiting factors: exploitation depends on already holding elevated privileges within the application (no unauthenticated path), the product is a niche self-hosted PHP application with small deployment footprint, and impact is confined to Low confidentiality/integrity/availability effects on configuration data rather than full system compromise.

This is a high-CVSS-in-name-only issue that resolves to genuinely low real-world risk. The vendor (VulDB) CVSS 4.0 base score is only 5.1 (medium), with a vector of AV:N/AC:L/PR:H/UI:N and uniformly Low impacts (VC:L/VI:L/VA:L), so even the reported score is modest. The PR:H requirement means an attacker must already hold high privileges in the application, which sharply limits the population of realistic threat actors and contradicts the 'Authentication Bypass' tag - the underlying weakness is CWE-285 improper authorization (an authorization/privilege-boundary flaw), not an authentication bypass. Exploitation status: publicly available exploit code exists (referenced GitHub issue #12), but there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active exploitation - POC availability and active exploitation are distinct signals and should not be conflated. No SSVC decision data was supplied. The E:P (Proof-of-Concept exploit maturity) in the 4.0 vector is consistent with the public POC but not with weaponized in-the-wild use. Net: a low-priority, low-impact authorization defect in a niche product, elevated only slightly by public POC code.

An attacker who already possesses a high-privilege authenticated account (or has compromised one) on a deployed HospitalManagement instance sends a crafted request to the sistem.php simpan configuration handler, manipulating the tipe/title/content_setting parameters to alter system settings they should not be authorized to change. A public proof-of-concept exists in the vendor's GitHub issue tracker (#12), lowering the effort to reproduce, though the high-privilege prerequisite limits practical impact.