CVE-2026-96550 in hosp_order
Summary
by MITRE • 09/23/2026
A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This issue affects the function getProperties of the file ssm_pro/src/main/java/cn/sfturing/utils/MailUtil.java. Performing a manipulation results in cleartext transmission of sensitive information. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is assessed as difficult. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The identified vulnerability resides within the sfturing hosp_order software, specifically affecting versions up to commit hash 627f426331da8086ce8fff2017d65b1ddef384f8. The root cause is located in the getProperties method of the MailUtil.java file within the ssm_pro source directory. This flaw constitutes a critical security deficiency where sensitive information is transmitted over network connections without encryption, resulting in cleartext exposure. In modern application architecture, email transmission often involves handling credentials, personal identifiable information, or internal system alerts. When such data is sent via unencrypted protocols like SMTP without TLS/SSL wrapping, it becomes susceptible to interception by any entity capable of monitoring the network traffic between the mail server and the destination endpoint. This scenario aligns directly with CWE-319, which classifies cleartext transmission of sensitive information as a significant weakness in cryptographic implementation practices.
From an operational perspective, this vulnerability allows for remote exploitation, meaning that an attacker does not need physical or local access to the target system to initiate the attack. However, the complexity is assessed as high and exploitability as difficult, suggesting that while the flaw exists, leveraging it requires specific conditions such as network position within a non-segmented environment or compromised intermediate nodes. Despite these barriers, the fact that an exploit has been made public significantly elevates the risk profile for organizations still running affected versions. Publicly available exploits lower the barrier to entry for malicious actors who may lack sophisticated development skills but can utilize existing tools to capture sensitive data in transit. This situation is particularly concerning given the continuous delivery model with rolling releases employed by this product, which complicates version tracking and patch management efforts since there are no discrete version numbers to reference for affected or updated builds.
The security implications of cleartext email transmission extend beyond simple data interception. It violates fundamental principles of confidentiality mandated by industry standards such as PCI DSS Requirement 4 and HIPAA Security Rule §164.312(a)(2)(iv), both of which require the use of cryptographic mechanisms to protect electronic protected health information or cardholder data during transmission over open, public networks. Furthermore, this vulnerability can be mapped to MITRE ATT&CK technique T1048, specifically sub-technique 001 (Encryption Protocol Manipulation) or generally under Exfiltration Over Alternative Protocol if the email channel is abused for data theft. The lack of response from the project maintainers despite early notification through an issue report presents a challenge for users who rely on upstream fixes. Consequently, organizations must implement compensating controls to mitigate this risk immediately.
To address this vulnerability effectively, immediate remediation strategies should focus on enforcing encrypted communication channels for all email operations within the application. This involves configuring the MailUtil.java module to utilize SMTPS (SMTP over SSL/TLS) or STARTTLS protocols with strict certificate validation to prevent man-in-the-middle attacks that could downgrade connections to cleartext. Additionally, network-level mitigations such as deploying intrusion detection systems capable of identifying unencrypted email traffic and enforcing TLS policies at the mail server level can provide defense in depth. For organizations unable to immediately patch due to the rolling release nature of the software, isolating the application from public-facing networks or restricting its access to trusted internal subnets where encryption enforcement is managed by infrastructure components like reverse proxies with SSL termination can serve as a temporary safeguard until an official patched version becomes available and verified for stability.