The vulnerability exists in the function cekUserLogin within application/models/app_user_login_model.php of the gedelumbung HospitalManagement product. It involves the KCFinder File Manager component where manipulation of the ADMIN_RS_KCFINDER argument leads to unrestricted file upload capability. This flaw can be exploited remotely without user interaction and requires low privileges. The product follows a rolling release model, so no discrete version numbers are provided for affected or patched releases. The vendor has been notified but has not responded or issued a fix. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation allows remote attackers to upload arbitrary files to the server without restriction. This can lead to unauthorized file placement, potentially enabling further attacks such as remote code execution or data compromise. The vulnerability requires low privileges and no user interaction, increasing its risk. However, no active exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. Until a fix is available, consider restricting access to the vulnerable component or disabling the KCFinder File Manager if possible to reduce exposure.