An attacker can manipulate the nama, email, alamat, telepon, or pesan fields in the kirim function of contact.php, injecting JavaScript that is reflected back to the victim’s browser. This reflected cross‑site scripting flaw, classified as CWE‑79, enables an attacker to run arbitrary code in the context of the hospital management web application, potentially leading to data theft or session hijacking.

The flaw is present in the gedelumbung HospitalManagement application, specifically in the contact.php controller of the Contact Form module. Affected code versions include all releases up to commit c2d45543789a3887067d3915f69d44cfc2cf76a8. Because the project uses a rolling‑release model, precise version numbers are not published, so any active deployment may contain the vulnerability unless updated.

The CVSS score of 5.3 indicates a moderate risk, and the absence of an EPSS score suggests limited publicly measured exploitation data. Nevertheless, the vulnerability is exploitable remotely, and publicly disclosed exploit code is available, which raises concern. The product is not listed in CISA’s KEV catalog, but the existence of a publicly exposed attack vector means administrators should consider mitigating the issue promptly.