Description

A security flaw has been discovered in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function modifyPassWord of the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java of the component Password Recovery. Performing a manipulation results in unverified password change. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-07T03:17:17.647Z",
  "pubdate": "2026-09-07T03:17:17.647Z",
  "executiveSummary": "A critical security flaw has been identified in the Password Recovery component of the sfturing hosp_order application, specifically within the CommonUserController class.\nThe vulnerability is characterized as an unverified password change flaw, allowing unauthorized users to modify existing account credentials without proper validation of current credentials or ownership.\nThe affected codebase includes versions up to commit 627f426331da8086ce8fff2017d65b1ddef384f8.\nThe vulnerability is exploitable remotely, does not require authenticated access, and has public exploit availability, significantly increasing the risk profile.\nSuccessful exploitation allows an attacker to gain full control over targeted user accounts, leading to unauthorized data access, system disruption, and potential lateral movement within the application environment.\nGiven the absence of a vendor response to reported issues, the system remains at high risk for exploitation.",
  "technicalDetails": "The vulnerability resides within the modifyPassWord function in the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java.\nThe root cause of this flaw is improper authentication and authorization checks during the password update process. The application fails to verify the identity of the requester before allowing modification of the stored password credentials.\nBy design, the modifyPassWord function should require the previous password to be provided or a cryptographically secure token to be validated before updating the database. The implementation lacks these safeguards, effectively treating password change requests as implicitly trusted.\nThe exploitation flow involves an attacker crafting an HTTP request directed at the endpoint mapping associated with modifyPassWord. Because the application logic does not validate the session context or the user's current password, an attacker can bypass the password update constraints by directly submitting the desired target username and the new password as parameters to the vulnerable function.\nSince the function lacks sufficient server-side access control, a remote, unauthenticated attacker can supply arbitrary parameters to the backend controller. This manipulation triggers the application to execute the database update operation, effectively overwriting the legitimate user's password with the attacker-controlled value.\nThis vulnerability is remotely exploitable, meaning an attacker does not require local network access to the server, provided the application endpoint is reachable over the network. The absence of rate limiting or verification steps allows for bulk exploitation, which could lead to mass account hijacking.\nPost-exploitation impact is severe, as the attacker achieves full unauthorized access to user accounts. This allows the adversary to bypass authentication mechanisms, gain access to sensitive health or organizational data stored within the hosp_order application, and perform further administrative actions if the compromised account possesses elevated privileges."
}