SQL Injection Vulnerability in gedelumbung HospitalManagement Application
CVE-2026-92221

5.1MEDIUM

Key Information:

Vendor: Gedelumbung
Status: Hospitalmanagement
Vendor: CVE Published:; 16 September 2026

🔔 Create Gedelumbung Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-92221?

A vulnerability has been identified in the gedelumbung HospitalManagement application that allows for SQL injection attacks via the generate_index_pasien function in the app_global_admin_model.php file. By manipulating the input argument 'cari', attackers can execute unauthorized SQL commands remotely. This issue has been publicly disclosed, and, despite prior notification to the developers through an issue report, no official response has been issued regarding a fix. The application's development model, which features rolling releases, complicates version management and timely updates.

Affected Version(s)

HospitalManagement c2d45543789a3887067d3915f69d44cfc2cf76a8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-92221 - Proof of Concept