CVE-2026-92221
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A vulnerability was determined in gedelumbung HospitalManagement (up to c2d45543789a3887067d3915f69d44cfc2cf76a8) in the generate_index_pasien function of application/models/app_global_admin_model.php. Manipulation of the 'cari' argument can lead to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed and may be utilized. The project has not responded to the issue report.
Risk Assessment
SQL injection may allow an attacker to access, modify, or delete sensitive data, potentially compromising system security. The publicly available exploit increases the risk of rapid exploitation.
Recommendation
It is recommended to apply mitigations as soon as possible, such as input validation and parameterized SQL queries, since the project has not yet provided an official fix.
Other vulnerabilities in HospitalManagement
See all- CVE-2026-93532Medium
gedelumbung HospitalManagement up to version c2d45543789a3887067d3915f69d44cfc2cf76a8 has a vulnerability in the password change and profile functions where manipulation of the kode_user/username argument leads to improper authentication. The attack can be launched remotely, and the exploit has been publicly disclosed. The project has not responded.
- CVE-2026-93531Medium
gedelumbung HospitalManagement up to version c2d45543789a3887067d3915f69d44cfc2cf76a8 has a cross-site request forgery (CSRF) vulnerability in unknown code. The attack can be initiated remotely, and the exploit has been made public. The project has not responded.
Original NVD description (English source)
A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this vulnerability is the function generate_index_pasien of the file application/models/app_global_admin_model.php. Executing a manipulation of the argument cari can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.