Description

A weakness has been identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The impacted element is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Controller. Executing a manipulation of the argument userIdenf can lead to authorization bypass. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-07T03:17:18.723Z",
  "pubdate": "2026-09-07T03:17:18.723Z",
  "executiveSummary": "A critical authorization bypass vulnerability has been identified in the Order Controller component of sfturing hosp_order, affecting versions up to 627f426331da8086ce8fff2017d65b1ddef384f8.\nThe vulnerability originates from improper validation of the userIdenf argument within the OrderController.java file.\nThis flaw allows remote, unauthenticated attackers to manipulate user-supplied input to perform unauthorized actions, potentially leading to unauthorized data access or modification within the hospital ordering system.\nGiven that the exploit is publicly available, the risk to affected deployments is high.\nThe absence of a vendor response to the disclosed issue exacerbates the security risk, as no official patch is currently available to remediate the vulnerability in this rolling-release project.",
  "technicalDetails": "The vulnerability is located in the ssm_pro/src/main/java/cn/sfturing/web/OrderController.java file within the Order Controller component. The root cause is an insecure implementation of access control logic regarding the processing of the userIdenf parameter.\nThe application fails to properly verify or enforce authorization constraints when the userIdenf argument is provided during an order-related request. This indicates that the backend application logic relies on user-supplied input to determine the identity or permissions of the requester without performing necessary server-side validation against the session or authentication token.\nAn attacker can exploit this by crafting a malicious HTTP request directed at the affected controller. By manipulating the userIdenf value in the request payload—typically through parameters or header injection—the attacker can masquerade as a different user, often an administrator or a privileged user, effectively bypassing existing authorization checks.\nBecause the application does not strictly validate the mapping between the provided userIdenf and the actual authenticated user context, the server treats the manipulated identifier as authoritative. This allows for remote, unauthorized access to sensitive functions intended for restricted users.\nThe attack flow proceeds as follows: First, the attacker identifies an accessible endpoint within OrderController that processes the userIdenf parameter. Second, the attacker intercepting or crafting the request substitutes the legitimate user identifier with a target identifier (such as an admin UID). Third, the application consumes the malicious userIdenf, incorrectly authorizing the attacker to execute operations or access resources associated with the target account.\nThe impact of this vulnerability is significant, as it enables unauthorized data exfiltration, unauthorized modification of order records, and potentially escalation of privileges within the hospital information system. As the exploit is public, the attack vector is easily repeatable by malicious actors targeting systems running the affected code commit."
}