The HospitalManagement application contains an open redirect in the routing_pages controller, specifically the simpan function that processes the url_route argument. By supplying a crafted value, an attacker can cause the server to redirect users to an arbitrary external URL, potentially facilitating phishing or delivery of malicious content. The flaw can be triggered remotely and is publicly known; it does not grant direct access to the system, but it can undermine user trust and be used as a vector for other attacks.

The vulnerability is present in all releases of gedelumbung HospitalManagement up to the commit identified by c2d45543789a3887067d3915f69d44cfc2cf76a8. No specific release numbers are currently available because the project uses a rolling release model, so the flaw may exist in any deployed instance of the application.

The CVSS score of 5.3 indicates a moderate severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw from an external network by sending a crafted URL that includes a malicious url_route parameter, leading end‑users to attacker‑controlled sites. The lack of an available patch and the public nature of the exploit increase the likelihood that the flaw will be abused in the wild.