Description

A flaw has been found in sfturing ssm_pro up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Endpoint. This manipulation of the argument hospitalName/officesName/doctorName causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-07T03:17:19.243Z",
  "pubdate": "2026-09-07T03:17:19.243Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the sfturing ssm_pro application, specifically affecting the Order Endpoint component. The flaw arises due to improper sanitization of user-supplied input parameters within the OrderController.java file.\nThe vulnerability allows remote, unauthenticated attackers to inject malicious scripts into the web application, which are then executed in the context of the victim's browser session.\nThe impact includes potential session hijacking, unauthorized access to sensitive user data, and the execution of arbitrary actions on behalf of the affected user.\nThis vulnerability affects sfturing ssm_pro up to commit version 627f426331da8086ce8fff2017d65b1ddef384f8.\nGiven that public exploit code is available and the vendor has not provided a response or patch, the risk level is considered high for exposed instances.",
  "technicalDetails": "The vulnerability is a reflected Cross-Site Scripting (XSS) flaw located in the ssm_pro/src/main/java/cn/sfturing/web/OrderController.java component of the ssm_pro application. The root cause is the failure of the application to perform adequate input validation or output encoding on user-controllable arguments, specifically 'hospitalName', 'officesName', and 'doctorName'.\nWhen an application processes these parameters and reflects them back into the HTTP response body without proper context-aware encoding, it creates an injection vector. An attacker can craft a malicious URL containing a JavaScript payload within one of these vulnerable parameters. When a victim clicks the link, the server processes the request and embeds the attacker's script directly into the resulting HTML page.\nThe browser, unable to distinguish between legitimate application code and the attacker's injected script, executes the payload within the security context of the origin. This allows the attacker to access cookies (if the HttpOnly flag is not set), read sensitive session tokens, manipulate the Document Object Model (DOM), or perform unauthorized actions on the application interface as the logged-in user.\nThe attack flow proceeds as follows: 1) The attacker identifies a target installation of ssm_pro. 2) The attacker crafts a request using the vulnerable parameters (hospitalName, officesName, or doctorName) to include a malicious script (e.g., <script>alert(document.cookie)</script>). 3) The attacker induces a user or administrator to navigate to the malicious URL. 4) The server reflects the script back to the victim's browser. 5) The browser interprets the script as legitimate source code and executes it. 6) The script exfiltrates session data or redirects the user to a malicious site. Because the vulnerability is accessible remotely, it does not require prior authentication, significantly increasing the attack surface.\nThe vulnerability persists in all versions up to 627f426331da8086ce8fff2017d65b1ddef384f8. Post-exploitation, the impact depends on the privileges of the victim, potentially leading to full account takeover or unauthorized modification of system records."
}