Executive brief
gedelumbung HospitalManagement is a web-based hospital management system built with CodeIgniter. The application ships with CSRF protection disabled by default, allowing attackers to forge requests on behalf of logged-in administrators through malicious web pages. An attacker could create rogue admin accounts, modify patient records, plant persistent malware, or reset passwords without the administrator's knowledge.
Technical details
The vulnerability stems from CodeIgniter's CSRF protection being explicitly disabled in the application configuration ($config['csrf_protection'] = FALSE) combined with session cookies lacking HttpOnly, Secure, and SameSite attributes. An unauthenticated attacker can craft a malicious HTML page that auto-submits POST requests to any admin endpoint (user management, patient data, routing pages, etc.) when a logged-in administrator visits the page. The application accepts these forged requests without token validation, enabling account creation, data modification, and stored XSS injection across multiple admin modules.
Affected products
- gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8
Timeline
- 2026-08-22: disclosed: Issue #6 reported on GitHub
- 2026-09-18: advisory: CVE-2026-93531 published