sfturing hosp_order vulnerabilities

A vulnerability was found in the sfturing hosp_order project in an unknown function of ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java. Manipulation leads to cross-site request forgery, and the attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

In sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, a flaw exists in an unknown part of the file ssm_pro/src/main/resources/jdbc.properties, causing hard-coded credentials. The attack can be initiated remotely, its complexity is rated high, and exploitability is indicated as difficult. The exploit has been published and may be used. This product uses a rolling release for continuous delivery, so no version details for affected or updated releases are available. The project was informed early via an issue report but has not responded.

A vulnerability was identified in sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. An unknown function in HospitalController.java of the Public Search Handlers component is affected. Manipulation of the Search argument leads to cross-site scripting. The attack can be initiated remotely, and the exploit is publicly available. The project has not responded.

A security flaw was discovered in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected function is modifyPassWord in the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java (Password Recovery component). Manipulation results in unverified password change. Remote exploitation is possible, and the exploit has been released publicly. The project has not responded yet.