Soumettre #722925: https://github.com/sfturing/hosp_order hosp_order latest SQL Injection

Hosporder is an open-source hospital appointment registration system that contains unchecked controllable input, which is directly concatenated into the LIKE keyword in SQL statements, leading to SQL injection vulnerabilities.

Under function cn.sfturing.dao.HospitalDao#findOrderHosNum. findOrderHosNum has unverified risk points '%${hospitalAddress}%' and '%${hospitalName}%'. From source 'Hospital hosp' which in function 'cn.sfturing.web.HospitalController#orderHos'. Then propagate to function 'cn.sfturing.service.impl.HospitalServiceImpl#findOrderHosNum'. Finally arrived at the taint sink 'cn.sfturing.dao.HospitalDao#findOrderHosNum'.

• La source: ⚠️ https://github.com/sfturing/hosp_order/issues/111
• Utilisateur: mukyuuhate (UID 93052)
• Soumission: 24/12/2025 14:22 (il y a 10 mois)
• Modérer: 04/01/2026 09:42 (11 days later)
• Statut: Accepté
• Entrée VulDB: 339483 [sfturing hosp_order /ssm_pro/orderHos/ findOrderHosNum hospitalAddress/hospitalName injection SQL]
• Points: 20