CVE-2026-102847: HospitalManagement Guest Book XSS Vulnerability

CVE-2026-102847 Overview

CVE-2026-102847 is a cross-site scripting (XSS) vulnerability [CWE-79] in the gedelumbung HospitalManagement application. The flaw resides in the kirim function of application/modules/web/controllers/buku_tamu.php, which handles Guest Book submissions. Attackers can manipulate the nama, email, or pesan parameters to inject arbitrary script content that executes in the context of other users' browsers. The vulnerability affects all commits up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Because the project follows a rolling-release model, no fixed version identifiers are published. The exploit has been publicly disclosed, and the maintainer has not responded to the initial issue report.

Critical Impact
Remote attackers can inject arbitrary JavaScript into the Guest Book, enabling session theft, phishing, and browser-based attacks against users who view guest entries.

Affected Products

gedelumbung HospitalManagement (all commits up to c2d45543789a3887067d3915f69d44cfc2cf76a8)
Guest Book component (application/modules/web/controllers/buku_tamu.php)
Rolling-release distribution; no versioned build identifiers are published

Discovery Timeline

2026-09-30 - CVE CVE-2026-102847 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-102847

Vulnerability Analysis

The issue is a stored or reflected cross-site scripting flaw in the Guest Book feature of HospitalManagement. The kirim function in buku_tamu.php accepts user-supplied input through the nama (name), email, and pesan (message) parameters. The application processes these values without adequate output encoding or input sanitization before rendering them in HTML responses.

Remote attackers can submit crafted guest-book entries containing HTML or JavaScript payloads. When staff or other visitors view the guest-book page, the injected script runs in their browsers under the origin of the vulnerable application. This allows session cookie theft, credential harvesting via injected forms, and forced browser actions against authenticated administrators.

Root Cause

The root cause is missing neutralization of input during web page generation [CWE-79]. The kirim handler in application/modules/web/controllers/buku_tamu.php does not apply context-aware escaping such as htmlspecialchars with ENT_QUOTES before echoing the nama, email, or pesan fields into HTML output. Server-side validation of these inputs is also absent.

Attack Vector

Exploitation requires network access to the Guest Book submission endpoint and minimal user interaction. An unauthenticated attacker submits a guest-book entry containing a script payload in any of the affected parameters. Any subsequent visitor to the rendered Guest Book page triggers execution of the payload. No privileges are required to submit the initial payload.

Refer to the VulDB advisory for CVE-2026-102847 and GitHub Issue #13 for technical context.

Detection Methods for CVE-2026-102847

Indicators of Compromise

Guest Book database entries in buku_tamu tables containing HTML tags such as <script>, <img onerror=, <svg onload=, or javascript: URIs in the nama, email, or pesan columns.
Web server access logs showing POST requests to /web/buku_tamu/kirim with URL-encoded angle brackets or common XSS payload markers.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing the Guest Book.

Detection Strategies

Deploy a web application firewall (WAF) rule set that flags XSS signatures targeting the /web/buku_tamu/ route and the nama, email, and pesan parameters.
Perform periodic queries against the guest-book data store for HTML control characters or script tags in user-supplied fields.
Review browser Content Security Policy (CSP) violation reports for inline script executions originating from the Guest Book page.

Monitoring Recommendations

Alert on HTTP requests to the Guest Book endpoint containing suspicious payload patterns such as <script, onerror=, or onload=.
Monitor administrator sessions for anomalous cookie access, unexpected privilege changes, or session hijacking indicators after Guest Book views.
Correlate outbound network traffic from staff endpoints with recent Guest Book page loads to detect data exfiltration attempts.

How to Mitigate CVE-2026-102847

Immediate Actions Required

Disable or restrict access to the Guest Book component until sanitization is implemented, or place the endpoint behind authentication.
Purge existing guest-book entries that contain HTML or script content to prevent stored payloads from executing against future visitors.
Apply a WAF rule blocking script tags and event-handler attributes in requests targeting /web/buku_tamu/kirim.

Patch Information

No vendor patch is available. The maintainer has not responded to GitHub Issue #13. Because the project uses a rolling-release model, operators must apply mitigations directly to their deployed source until an upstream fix is merged into the HospitalManagement repository.

Workarounds

Modify the kirim function in application/modules/web/controllers/buku_tamu.php to apply htmlspecialchars($value, ENT_QUOTES, 'UTF-8') to the nama, email, and pesan inputs before storage and on output rendering.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Require authenticated submissions and add server-side length and character-class validation for guest-book fields.

bash

# Example Apache mod_security rule blocking common XSS payloads on the Guest Book endpoint
SecRule REQUEST_URI "@beginsWith /web/buku_tamu/kirim" \
    "phase:2,deny,status:403,id:1029847,\
    chain,msg:'Blocked XSS attempt against HospitalManagement Guest Book (CVE-2026-102847)'"
    SecRule ARGS:nama|ARGS:email|ARGS:pesan "@rx (?i)(<script|onerror=|onload=|javascript:)"