Description

A security vulnerability has been detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects the function updateOrderSta1/updateOrderdiseaseInfo of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Handler. The manipulation of the argument userID/id leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-07T03:17:18.893Z",
  "pubdate": "2026-09-07T03:17:18.893Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the Order Handler component of the sfturing hosp_order project, specifically within the OrderController.java file.\nThe vulnerability arises from insufficient access control checks when handling the 'userID' and 'id' parameters in the updateOrderSta1 and updateOrderdiseaseInfo functions.\nThis flaw allows remote, unauthenticated, or low-privileged attackers to perform unauthorized operations by manipulating these arguments.\nBecause the project utilizes a rolling release strategy and remains unpatched, the risk of exploitation is elevated for all deployments up to commit 627f426331da8086ce8fff2017d65b1ddef384f8.\nSuccessful exploitation grants an attacker the ability to modify order status or disease information without proper authorization, potentially leading to unauthorized data manipulation or integrity compromise within the application environment.",
  "technicalDetails": "The vulnerability is classified as an authorization bypass, residing in the cn.sfturing.web.OrderController.java file within the ssm_pro module.\nThe root cause is an insecure implementation of access control logic within the updateOrderSta1 and updateOrderdiseaseInfo functions. These functions fail to validate whether the current authenticated user session possesses the appropriate privileges to modify records associated with the provided 'userID' or 'id' parameters.\nIn a typical request flow, the application receives a request intended to update sensitive order data. The OrderController processes these requests by directly trusting the user-supplied 'userID' or 'id' identifiers provided in the request body or parameters. Because the application logic lacks a secondary validation check—often referred to as an Indirect Object Reference (IDOR) flaw—the system executes the update operation against the specified record regardless of the requester's actual ownership or permission status.\nThe attack is remotely exploitable, requiring no specific credentials if the endpoints are exposed publicly, or allowing privilege escalation if the attacker has limited access. By crafting a HTTP request targeting these endpoints and replacing the ID parameters with target records, an attacker can effectively bypass server-side security checks.\nThe payload involves sending a crafted request to the vulnerable endpoints. The application retrieves the specified object from the database based on the user-controlled input and proceeds to modify its internal state. Since the controller assumes the request is legitimate based on the mere existence of a session, the backend persists the unauthorized changes.\nThe impact of this vulnerability is significant, as it permits unauthorized state changes in critical business logic, specifically within the hosp_order management workflow. Attackers can manipulate medical or order status information, leading to severe data integrity issues and potential misuse of the underlying health-related services."
}