CVE-2026-96551 in hosp_order
Summary
by MITRE • 09/23/2026
A vulnerability was determined in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Impacted is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java. Executing a manipulation can lead to cross-site request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The identified vulnerability resides within the sfturing hosp_order component, specifically affecting a function in the CommonUserController.java file located at ssm_pro/src/main/java/cn/sfturing/web/. This security flaw is classified as a Cross-Site Request Forgery (CSRF) issue. CSRF attacks exploit the trust that a web application has in a user's browser to perform unauthorized actions on behalf of that authenticated user without their knowledge or consent. In this specific context, an attacker can craft malicious requests that trick a victim into performing state-changing operations within the sfturing hosp_order system while they are still logged in and authenticated by the target service.
The technical nature of this vulnerability indicates a failure to implement adequate anti-CSRF mechanisms such as synchronizer tokens or same-site cookie attributes for sensitive endpoints handled by the CommonUserController. When an application relies solely on session cookies for authentication without verifying the origin of requests, it becomes susceptible to manipulation from external domains. An attacker can host a malicious webpage containing forged HTTP requests that target specific API endpoints within the sfturing ecosystem. Upon visiting this page while authenticated in another tab or window with the victim's credentials, the browser automatically includes valid session cookies, allowing the attack to succeed and execute commands under the user's privilege level.
The operational impact of this vulnerability is significant due to its remote exploitability and public disclosure status. Since the exploit has been publicly disclosed, automated scanning tools and malicious actors can readily identify vulnerable instances on the internet. The ability to launch attacks remotely means that no physical proximity or local network access is required for exploitation. Depending on the specific permissions associated with the affected function in CommonUserController.java, an attacker could potentially alter user data, modify system configurations, perform financial transactions if applicable, or escalate privileges within the application logic. This poses a direct threat to data integrity and confidentiality, undermining the trust users place in the sfturing platform.
The lack of versioning information complicates remediation efforts as there is no clear mapping between specific releases and affected code states. The project has been notified via an issue report but has not yet provided a patch or acknowledgment. In such scenarios where vendor response is delayed, organizations must rely on compensating controls to mitigate risk. Implementing strict Content Security Policy headers can help restrict the sources from which scripts are executed, thereby reducing the effectiveness of CSRF payloads delivered through malicious web pages. Additionally enforcing SameSite cookie attributes ensures that cookies are not sent with cross-site requests, effectively neutralizing many standard CSRF attack vectors even if server-side token validation is absent or incomplete.
From a classification perspective, this vulnerability aligns with CWE-352 Cross-Site Request Forgery (CSRF). It also maps to the MITRE ATT&CK framework under techniques related to Session Hijacking and potentially Command Injection depending on the specific actions allowed by the compromised function. Security teams should prioritize monitoring for unusual request patterns originating from unknown domains targeting these endpoints. Until a vendor-provided fix is available, deploying Web Application Firewall rules that detect and block malformed or suspiciously structured requests directed at the CommonUserController can provide an additional layer of defense against exploitation attempts in production environments.