This vulnerability in gedelumbung HospitalManagement is a cross-site request forgery (CSRF) flaw that affects the software up to the specified commit c2d45543789a3887067d3915f69d44cfc2cf76a8. The weakness allows remote attackers to trick authenticated users into submitting unauthorized requests, potentially leading to unintended actions within the application. Due to the rolling release model of the product, precise affected versions cannot be enumerated. The vendor has been notified but has not yet issued a response or patch. Public exploit code exists, indicating the vulnerability could be leveraged in attacks.

An attacker can remotely exploit this CSRF vulnerability to cause an authenticated user to perform unintended actions without their consent. This could lead to unauthorized operations within the HospitalManagement system. The vulnerability does not require privileges or user interaction beyond the victim visiting a malicious site. The CVSS 4.0 base score is 5.3, indicating a medium impact with network attack vector, low attack complexity, no privileges required, but requiring user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should implement standard CSRF mitigations such as verifying anti-CSRF tokens on state-changing requests and restricting cross-origin requests where possible until an official patch is released.