EUVD-2026-72237
GHSA-hp37-j4p8-ghjr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to OrderController
-
ExploitSupply arbitrary userIdenf parameter
-
ExecutionBypass per-user authorization check
-
ImpactRead or modify target user's order records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | No special conditions are required beyond network access to the running hosp_order web application - the CVSS 4.0 vector (PR:N, AC:L, AT:N) confirms unauthenticated remote exploitation against default configurations. The specific limiting factor is the deployment footprint: this is an obscure, small-scale Java project unlikely to be internet-facing in production environments. Exploitation requires the attacker to know or enumerate valid |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) scores 6.9, reflecting a low-complexity, network-accessible, unauthenticated attack with limited per-axis impact. The |
| Exploit ScenarioDerived | An unauthenticated attacker sends an HTTP request to the hospital order application's OrderController endpoint, substituting an arbitrary value for the |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 07, 2026
Authorization bypass through user-controlled key (IDOR, CWE-639) in sfturing hosp_order's OrderController allows unauthenticated remote attackers to access or manipulate hospital order records belonging to arbitrary users by supplying a crafted userIdenf parameter. The affected codebase is a Java Spring-based hospital order management system, and the vulnerability is exposed via the /ssm_pro web application endpoint. A public proof-of-concept exists via GitHub issue #114; the maintainer has not responded to the disclosure, and no patch has been released.
RemediationAI
No vendor-released patch has been identified at time of analysis; the maintainer had not responded to the issue report as of disclosure. As an immediate compensating control, restrict network access to the OrderController endpoints (e.g., by placing the application behind a VPN or IP allowlist) to reduce the attack surface to trusted users only. Server-side fix should enforce that the authenticated session's identity is used to authorize order access rather than a caller-supplied userIdenf parameter - the application must independently validate that the requesting session owns the referenced resource. Until patched, disabling or gating the affected order endpoints at the web application firewall or reverse proxy level will prevent exploitation at the cost of reduced functionality. Advisory and PoC details are available at https://vuldb.com/vuln/399407 and https://github.com/sfturing/hosp_order/issues/114.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
hosp_order (CPE: cpe:2.3:a:sfturing:hosp_order:*:*:*:*:*:*:*:*) is a Java-based hospital ordering system built on the Spring MVC (SSM) stack, as indicated by the ssm_pro module path. The vulnerable class cn.sfturing.web.OrderController handles order-related HTTP requests. CWE-639 (Authorization Bypass Through User-Controlled Key) describes a pattern where the application uses a caller-supplied value - here userIdenf - as a direct reference to a user identity or resource without independently verifying whether the caller is entitled to act on behalf of that identity. This is a classic Insecure Direct Object Reference (IDOR) pattern: by substituting another user's identifier, an attacker can cross authorization boundaries and read or modify that user's order data.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Unauthenticated network access with no complexity; limited C/I/A impact consistent with IDOR on order records, no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The impacted element is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Controller. Executing a manipulation of the argument userIdenf can lead to authorization bypass. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Related Vulnerabilities in sfturing hosp_order IDOR and Auth Flaws
View all 4Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Exploit-DB