CVE-2026-96552 in hosp_order
Summary
by MITRE • 09/23/2026
A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssm_pro/src/main/java/cn/sfturing/utils/MD5.java of the component User Password Handler. The manipulation leads to one-way hash without salt. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The identified vulnerability resides within the sfturing hosp_order software component, specifically affecting versions up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. The core technical flaw is located in the MD5.getMD5 function found within the source file ssm_pro/src/main/java/cn/sfturing/utils/MD5.java, which serves as part of the User Password Handler module. This implementation fails to incorporate a salt value when generating cryptographic hashes for user passwords. In modern security practices, hashing passwords without salting is considered a critical misconfiguration because it renders the resulting hash susceptible to pre-computed attacks such as rainbow table lookups and significantly weakens resistance against brute-force attempts. The absence of unique salts per password means that identical passwords across different users will produce identical hashes, allowing attackers who compromise one account's data to potentially infer credentials for other accounts using the same password.
From an operational perspective, this vulnerability allows for remote initiation by an attacker with network access to the affected system. However, the exploitability is characterized as difficult due to a high degree of complexity required to successfully leverage this flaw. This suggests that while the underlying cryptographic weakness exists, practical exploitation may require specific conditions or additional vulnerabilities in conjunction with this hash implementation issue. Despite the difficulty level, there are publicly available exploits for similar implementations which could be adapted by threat actors seeking to compromise user credentials. The rolling release model employed by the project complicates precise version tracking and patch verification, as continuous updates mean that specific fixed versions may not be clearly delineated in public documentation. This dynamic update strategy requires administrators to ensure they have pulled the latest code changes rather than relying on static version numbers for compliance or remediation efforts.
The security implications of this flaw align closely with CWE-757, which defines a weakness related to the use of one-way hashes without salt. By failing to implement proper salting mechanisms, the application violates fundamental principles outlined in industry standards such as OWASP guidelines for password storage and NIST Special Publication 800-63B regarding digital identity guidance. These standards explicitly recommend against using unsalted MD5 or SHA1 hashes for password verification due to their known vulnerabilities and speed of computation which facilitates rapid cracking attempts. Furthermore, the potential impact on confidentiality is significant as compromised credentials can lead to unauthorized access to sensitive patient health information within the hosp_order system, potentially violating regulatory requirements like HIPAA in healthcare contexts if applicable data is exposed through such breaches.
Mitigation strategies should prioritize immediate remediation by updating the MD5.getMD5 function to use a secure, salted hashing algorithm recommended for password storage, such as bcrypt, scrypt, or Argon2. These algorithms are designed to be computationally expensive and include built-in salting mechanisms that effectively neutralize rainbow table attacks and slow down brute-force attempts. If an immediate code change is not feasible due to the rolling release nature of the software, temporary mitigations could involve implementing application-level rate limiting on authentication endpoints to reduce the effectiveness of online brute-force attacks. Additionally, enforcing strong password policies can increase the entropy of user passwords, making them more resistant to cracking even if unsalted hashes are used temporarily. Organizations should also monitor for any new patches or commits from the project maintainers and verify that their deployed instances include these security improvements. Since the project has been informed but has not yet responded publicly, stakeholders should consider contributing to open source discussions or seeking alternative secure implementations if critical systems remain vulnerable.