Executive brief
HospitalManagement is a web-based system for managing hospital operations and user accounts. An authenticated attacker can change another user's password or display name by submitting crafted requests, because the application only checks that the attacker is logged in but does not verify they own the account being modified. This allows complete account takeover of other users, including administrators, and tampering with audit trails.
Technical details
The password change and profile update handlers in application/modules/global/controllers/password.php and profil.php perform IDOR attacks by accepting user identifiers (kode_user, username) from POST parameters without validating they match the authenticated session. The password endpoint has a weak guard requiring knowledge of the victim's current password, but the profile endpoint has no such protection. CSRF protection is globally disabled, allowing cross-site request forgery. A fix exists but the project has not yet responded to the disclosure.
Affected products
- gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8
Timeline
- 2026-08-22: disclosed: Issue reported on GitHub
- 2026-09-18: advisory: CVE-2026-93532 published