This vulnerability in gedelumbung HospitalManagement up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8 allows remote attackers to perform SQL injection via the 'cari' parameter in the generate_index_pasien function of application/models/app_global_admin_model.php. The vulnerability was reported early but remains unpatched, and the rolling release model means no fixed version is currently identified. The exploit has been publicly disclosed but is not known to be actively exploited in the wild.

Successful exploitation of this vulnerability could allow an attacker with high privileges to execute arbitrary SQL commands remotely, potentially leading to unauthorized data access or modification. The CVSS 4.0 score of 5.1 reflects a medium severity with network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts.

No official patch or remediation has been provided by the vendor yet. Users should monitor the vendor's project for updates and consider implementing application-level input validation or web application firewall rules to mitigate SQL injection risks until a fix is available.