Description

A vulnerability was detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Cancellation. The manipulation of the argument ID results in authorization bypass. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-07T03:17:19.070Z",
  "pubdate": "2026-09-07T03:17:19.070Z",
  "executiveSummary": "A critical authorization bypass vulnerability has been identified in the Order Cancellation component of the sfturing hosp_order project.\nThe vulnerability resides within the orderRecordsService.cancelOrder function located in ssm_pro/src/main/java/cn/sfturing/web/OrderController.java.\nThe issue stems from improper validation of the 'ID' argument, allowing unauthorized users to manipulate order cancellation requests.\nThis flaw enables an unauthenticated or unauthorized remote attacker to successfully cancel arbitrary orders within the system, leading to significant disruption of service and potential loss of data integrity.\nThe risk is exacerbated by the lack of vendor response and the public availability of the exploit code.\nSystems utilizing sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8 are considered vulnerable.",
  "technicalDetails": "The vulnerability is classified as an improper authorization flaw, specifically occurring within the OrderController component responsible for handling order lifecycle management.\nThe root cause is identified in the orderRecordsService.cancelOrder function, which fails to perform server-side verification of the requestor's identity against the requested resource ownership.\nThe application relies on client-supplied input via the 'ID' parameter to determine the target order for cancellation. Due to the absence of adequate access control checks (e.g., verifying if the currently authenticated user owns the order associated with the provided ID), the function proceeds to execute the cancellation logic based solely on the user-controlled input.\nExploitation is possible from remote network locations. An attacker can craft a specific HTTP request targeting the order cancellation endpoint, supplying a target 'ID' corresponding to an order they are not authorized to modify.\nThe attack flow follows these steps: 1) The attacker identifies the API endpoint associated with order cancellation. 2) The attacker intercepts or crafts a request containing an arbitrary 'ID'. 3) The application receives the request and passes the unvalidated 'ID' directly to the orderRecordsService.cancelOrder service layer. 4) The service layer, lacking sufficient authorization logic, validates only the existence of the order rather than the ownership or user permissions, subsequently executing the cancellation process.\nThis allows for unauthorized state transition of order objects, resulting in denial of service for the legitimate order owner and operational inconsistencies.\nThe vulnerability is present in all versions of the sfturing hosp_order project up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. Since the product utilizes a rolling release system, users are unable to rely on traditional versioning to determine their exposure status, necessitating an inspection of the source code commit history.\nPost-exploitation impact includes unauthorized modification of the database state, potential disruption of clinical or business workflows, and unauthorized access to functionality meant for administrative or privileged accounts."
}