# CVE-2026-92221: gedelumbung HospitalManagement SQL injection in patient search

Source: https://junglewise.ai/threats/cve-2026-92221-gedelumbung-hospitalmanagement-sql-injection-in-patient-search  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92221 · Severity: medium · CVSS 4.7 · Published 2026-09-16

HospitalManagement is an open-source hospital patient record system. The patient search feature contains a SQL injection vulnerability that allows authenticated administrators to bypass database security and extract sensitive patient health information (PHI), user credentials, and potentially execute arbitrary code on the server. The vulnerability requires admin login but no additional user interaction.

Technologies: [Gedelumbung HospitalManagement](https://junglewise.ai/threats/technologies/hospitalmanagement). Vendors: [Gedelumbung](https://junglewise.ai/threats/vendors/gedelumbung).

## Quick answers

**Is CVE-2026-92221 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92221 being exploited in the wild.

**How severe is CVE-2026-92221?** Medium severity, with a CVSS score of 4.7, published 16 September 2026.

**Which products and versions are affected?** Gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8.

**Is there a fix for CVE-2026-92221?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92221 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-92221?** Check whether you run Gedelumbung HospitalManagement at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the generate_index_pasien() function of application/models/app_global_admin_model.php. The vulnerable code mixes two escape strategies: the pagination calculation safely uses Active Record ORM escaping, but the main query hand-concatenates the user-controlled cari (search) parameter directly into a LIKE clause without sanitization. An authenticated admin can inject SQL by closing the LIKE string literal with a single quote and appending arbitrary SQL—for example, time-based SLEEP() commands or UNION-based data extraction. The attack is remotely exploitable over the network and requires admin authentication. An attacker can extract all patient records and user credentials, or leverage the database root account with FILE privilege to write web shells. No patch has been released; the project uses rolling releases and has not yet responded to the security report.

## Affected products

- gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8

## Timeline

- 2026-08-17: disclosed: Vulnerability reported via GitHub issue #4
- 2026-09-16: advisory: CVE-2026-92221 published to NVD

## References

- [https://github.com/gedelumbung/HospitalManagement/](https://github.com/gedelumbung/HospitalManagement/)
- [https://github.com/gedelumbung/HospitalManagement/issues/4](https://github.com/gedelumbung/HospitalManagement/issues/4)

## Related threats

- [gedelumbung HospitalManagement open redirect in routing pages](https://junglewise.ai/threats/cve-2026-115537-a-weakness-has-been-identified-in-gedelumbung-hospitalmanagement)
- [gedelumbung HospitalManagement stored XSS in routing pages](https://junglewise.ai/threats/cve-2026-115536-a-security-flaw-has-been-discovered-in-gedelumbung)
- [gedelumbung HospitalManagement stored XSS in contact form](https://junglewise.ai/threats/cve-2026-115534-a-vulnerability-was-determined-in-gedelumbung-hospitalmanagement)
- [gedelumbung HospitalManagement stored XSS in Guest Book](https://junglewise.ai/threats/cve-2026-102847-a-flaw-has-been-found-in-gedelumbung-hospitalmanagement-up-to)
- [gedelumbung HospitalManagement improper authorization in configuration handler](https://junglewise.ai/threats/cve-2026-102846-a-vulnerability-was-detected-in-gedelumbung-hospitalmanagement)