gedelumbung HospitalManagement Multiple Vulnerabilities

Information disclosure in gedelumbung HospitalManagement lets unauthenticated remote attackers obtain sensitive diagnostic output generated through the error_reporting handling in index.php, because PHP error text is emitted into HTTP responses. Exploitation requires only that the deployed instance runs with PHP error reporting/display enabled (the project's default or a common production misconfiguration) and that the attacker can remotely induce an error condition; no authentication or user interaction is needed (PR:N/UI:N). Publicly available exploit code exists (a public GitHub issue), and while CVSS 4.0 scores it 6.9 with E:P, our independent CVSS:3.1 assessment rates it as a low-severity confidentiality-only issue (C:L, no integrity or availability impact); there is no CISA KEV entry and no vendor-released patch identified at the time of analysis.

Cross-site scripting in the Guest Book component of gedelumbung HospitalManagement (PHP) allows remote, unauthenticated attackers to inject script payloads through the nama, email, and pesan fields handled by the kirim function in application/modules/web/controllers/buku_tamu.php, with the payload executing when a victim loads the affected guest-book page (publicly available exploit code exists; no confirmed active exploitation). The project ships as a rolling release, so no discrete affected or fixed version numbers exist - any deployment at or before commit c2d45543789a3887067d3915f69d44cfc2cf76a8 is presumed vulnerable. Impact is limited: the maintainer has not responded to the issue report and no vendor patch is available, but the required victim interaction, the low CVSS 2.1 base score, and a niche installation base keep this a low-priority finding.

Unrestricted file upload in gedelumbung HospitalManagement lets an authenticated low-privilege user abuse the ADMIN_RS_KCFINDER argument in the KCFinder File Manager to plant arbitrary files on the server, potentially escalating to remote code execution if the uploads land in a web-executable path. The project ships as a rolling release with no versioned tags, so all deployments tracking the repository up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8 are assumed affected; publicly available exploit code exists and the maintainer has not responded to the upstream issue report. Note that severity signals conflict: the supplied CVSS 4.0 score is 5.3 (Medium, with exploit maturity E:P), while our internal 3.1 assessment scores 8.8 (High) given the high confidentiality, integrity, and availability impact once code execution is achieved.

Path traversal (CWE-22) in the open-source PHP hospital management application gedelumbung HospitalManagement lets an attacker who already holds an authenticated admin-level session manipulate the 'gbr' argument passed to the hapus (delete) action in application/modules/admin/controllers/data_galeri.php, reaching files outside the intended gallery directory. The issue is remotely reachable with low complexity and no user interaction, but it is gated behind high privileges (PR:H), so it is not exploitable by an unauthenticated default user; our independent assessment rates the real-world risk as low-to-moderate despite the mid-range CVSS 4.0 base score of 5.1. Publicly available exploit code exists, there is no confirmed in-the-wild exploitation and no CISA KEV listing, and the project has not shipped a fixed release - the repository uses rolling delivery, so no affected or updated version numbers can be pinned.

Authorization bypass (CWE-639, IDOR) in gedelumbung HospitalManagement lets an authenticated user of the admin application read patient-report records belonging to other users by tampering with the id_param argument passed to the detail function in application/modules/admin/controllers/laporan_data_pasien.php. The flaw is remote and needs no user interaction, but the attacker must first hold a valid admin session, and impact is limited to read-only disclosure of patient report data (no integrity or availability effect); our independent assessment rates this CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, broadly consistent with the published CVSS 4.0 base score of 5.1 (Medium). Publicly available exploit code exists (the vendor GitHub issue thread serves as the proof of concept), but there is no confirmed active exploitation (CISA KEV). The project is unversioned, the vendor was notified via an issue report and has not responded, so no fixed release is identified at time of analysis.

Improper authorization in the gedelumbung HospitalManagement configuration handler lets an authenticated high-privilege user write arbitrary configuration values through the sistem.php 'simpan' action without the application enforcing an adequate access-control check. Only deployments running the current rolling-release codebase are affected, since the project publishes no versioned releases and the CPE entry carries a wildcard version; the practical exposure is limited to Low confidentiality, integrity, and availability impact on configuration data rather than full host or data compromise. Publicly available exploit code exists via the project's GitHub issue tracker (issue #12), but there is no indication of confirmed active exploitation, and the EPSS-style risk signal remains modest; the attacker must already hold an administrative session (CVSS PR:H, assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), which keeps real-world risk low despite the nominally elevated severity.