Description

A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file HospitalController.java of the component Public Search Handlers. The manipulation of the argument Search leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-22T14:17:20.547Z",
  "pubdate": "2026-09-22T14:17:20.547Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the HospitalController.java component of the sfturing hosp_order project, specifically impacting versions up to commit 627f426331da8086ce8fff2017d65b1ddef384f8.\nThe vulnerability manifests as a Reflected XSS, where the application fails to properly sanitize user-supplied input provided via the 'Search' parameter.\nBy injecting malicious client-side scripts into this parameter, an unauthenticated remote attacker can execute arbitrary JavaScript within the context of a victim's browser session.\nSuccessful exploitation poses a significant security risk, allowing for session hijacking, unauthorized actions performed on behalf of the user, and the exfiltration of sensitive information.\nThe vulnerability is currently unpatched, and functional exploit code is publicly available, increasing the likelihood of active exploitation.\nThis issue highlights a failure in input validation and output encoding mechanisms within the Public Search Handlers component.",
  "technicalDetails": "The vulnerability resides in the Public Search Handlers component of the sfturing hosp_order application, specifically within the HospitalController.java file.\nThe root cause is identified as improper neutralization of input during the processing of the 'Search' argument before it is reflected in the application's HTTP response.\nWhen a user navigates to a search-enabled page, the application takes the value provided in the 'Search' parameter and embeds it directly into the HTML markup without sufficient sanitization or output encoding.\nAn attacker can exploit this by crafting a malicious URL containing a JavaScript payload within the 'Search' argument. For example, injecting a string such as <script>alert(document.cookie)</script> into the parameter triggers the execution of the script when the victim's browser interprets the server's response.\nSince the attack is reflected, the exploitation flow involves the attacker tricking an authenticated or targeted user into clicking a specially crafted link. Upon clicking, the browser processes the malicious input as legitimate source code, thereby executing the payload within the security context of the origin domain.\nThe lack of appropriate Content Security Policy (CSP) headers or context-aware output encoding (such as HTML entity encoding) allows the script to bypass browser-based protections and manipulate the Document Object Model (DOM).\nPost-exploitation impacts include, but are not limited to, the theft of session tokens, redirection to malicious domains, the modification of page content to facilitate phishing, and the unauthorized interaction with the application's authenticated session state.\nBecause the vulnerability is triggered via a standard HTTP GET or POST request, no specific authentication or elevated privilege level is required to initiate the attack, making it accessible from any network location capable of reaching the web application interface.\nThe vulnerability persists in all versions of the software up to commit 627f426331da8086ce8fff2017d65b1ddef384f8, and the presence of publicly available exploit code facilitates automated or opportunistic attacks against deployments that have not implemented external compensating controls."
}