HospitalManagement XSS and Open Redirect Flaws

Cross-site scripting in the Admin Routing Page of gedelumbung HospitalManagement lets an attacker who controls the 'content' argument processed by the simpan function in application/modules/admin/controllers/routing_pages.php have script run in a user's browser when the affected page renders that content. The project uses a rolling release model, so no version range is published; builds up to and including commit c2d45543789a3887067d3915f69d44cfc2cf76a8 are reported affected. Impact is confined to low integrity with no confidentiality or availability effect, a public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry indicates active exploitation.

Cross-site scripting in the PHP-based HospitalManagement project (gedelumbung) lets remote, unauthenticated attackers inject script through the contact form fields nama, email, alamat, telepon and pesan, which the kirim function in application/modules/web/controllers/contact.php renders without adequate output encoding. The payload only fires when a victim - realistically an operator or administrator reviewing submitted contact entries - later views the affected page (CVSS 4.0 UI:P; our assessed 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), so impact is confined to the low-integrity script execution in that browser context rather than server compromise. Severity is low (CVSS 4.0 base 2.1, rated E:P) and the priority label is monitor; there is no CISA KEV entry, but the vendor report states the exploit has been publicly disclosed and exploit maturity is scored Proof-of-Concept, so a public PoC reference exists that has not been independently verified as working exploit code.

Open redirect in gedelumbung HospitalManagement affects the admin routing_pages.php 'simpan' function, where an attacker-supplied url_route value is not adequately validated before being used for a redirect. Remote attackers can craft a link that, when a victim follows it (UI:P), sends the browser to an attacker-chosen destination; no authentication is required (PR:N), but confidentiality and availability impact are none and integrity impact is low. A public PoC reference exists (GitHub issue #17) but is not verified as working exploit code; no CISA KEV entry is available and the project has not responded to the report, with the product on a rolling release and no version-specific fix identified.

Stored cross-site scripting in gedelumbung HospitalManagement lets an authenticated administrator inject script through the Title argument handled by sistem.php::simpan in the admin Settings Handler, and that payload then executes for users who view the page rendering the stored value. Scoring is 4.8 with the assessed vector requiring high privileges and user interaction, so real-world exposure is narrow - the realistic actor is an already-privileged operator or someone who has first taken over an admin session. A public PoC reference exists (the project's issue #15); it is not verified as working exploit code, no active exploitation is confirmed, and the vuln.today priority is this_month.