Executive brief
HospitalManagement is an open-source hospital patient record system. The patient search feature contains a SQL injection vulnerability that allows authenticated administrators to bypass database security and extract sensitive patient health information (PHI), user credentials, and potentially execute arbitrary code on the server. The vulnerability requires admin login but no additional user interaction.
Technical details
A SQL injection vulnerability exists in the generate_index_pasien() function of application/models/app_global_admin_model.php. The vulnerable code mixes two escape strategies: the pagination calculation safely uses Active Record ORM escaping, but the main query hand-concatenates the user-controlled cari (search) parameter directly into a LIKE clause without sanitization. An authenticated admin can inject SQL by closing the LIKE string literal with a single quote and appending arbitrary SQL—for example, time-based SLEEP() commands or UNION-based data extraction. The attack is remotely exploitable over the network and requires admin authentication. An attacker can extract all patient records and user credentials, or leverage the database root account with FILE privilege to write web shells. No patch has been released; the project uses rolling releases and has not yet responded to the security report.
Affected products
- gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8
Timeline
- 2026-08-17: disclosed: Vulnerability reported via GitHub issue #4
- 2026-09-16: advisory: CVE-2026-92221 published to NVD