CVE-2026-96551 Details
Description
A vulnerability was determined in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Impacted is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java. Executing a manipulation can lead to cross-site request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
A cross-site request forgery (CSRF) vulnerability has been identified in the Sfturing Hosp_Order application, specifically in the CommonUserController.java file. This vulnerability allows an attacker to manipulate authenticated users' profile data by exploiting endpoints that change personal information, such as mobile numbers and identity details. The issue arises because the application lacks proper CSRF protection for state-changing requests, trusting browser sessions without verification. The vulnerability is present in the latest commit (627f426331da8086ce8fff2017d65b1ddef384f8) and can be exploited remotely.
It is recommended to implement CSRF protection for all state-changing requests. This can be done by enabling framework-level CSRF safeguards, requiring validation tokens for each session or request, and checking the Origin or Referer headers as an additional layer of security. Furthermore, ensure that email verifications are successfully completed on the server side before allowing changes to phone numbers or personal identity information.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sfturing/hosp_order/ | [email protected] | ProductVendor |
| https://github.com/sfturing/hosp_order/issues/122 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://vuldb.com/cve/CVE-2026-96551 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/907907 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/408953 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/408953/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sfturing hosp_order | 627f426331da8086ce8fff2017d65b1ddef384f8 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | New CVE Received | [email protected] |