CVE-2026-96552 Details
Description
A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssm_pro/src/main/java/cn/sfturing/utils/MD5.java of the component User Password Handler. The manipulation leads to one-way hash without salt. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability exists in the Sfturing Hosp_Order application, specifically in the User Password Handler component. The issue arises from the function MD5.getMD5, located in the file ssm_pro/src/main/java/cn/sfturing/utils/MD5.java'. This vulnerability allows for one-way hashing of passwords using MD5, without the addition of salt, creating a deterministic hash that can be easily reversed. The problem was introduced in commit 627f426331da8086ce8fff2017d65b1ddef384f8 and affects the application's user password storage mechanism. The vulnerability can be exploited remotely, although it requires a high level of technical skill. The issue has been publicly disclosed and could potentially be exploited in the wild.
Passwords should be hashed using a secure algorithm designed for password storage, such as Argon2id, bcrypt, or PBKDF2, incorporating a unique random salt for each password and an appropriate work factor. After implementing this change, existing hashes should be migrated to the new format following a successful login, and credentials should be invalidated as per the incident response plan.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/sfturing/hosp_order/ | [email protected] | ProductSource CodeVendor |
| https://github.com/sfturing/hosp_order/issues/123 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-96552 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/907955 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/408954 | [email protected] | BundlePermission Required |
| https://vuldb.com/vuln/408954/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-325 | Missing Cryptographic Step | [email protected] |
| CWE-759 | Use of a One-Way Hash without a Salt | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sfturing hosp_order | 627f426331da8086ce8fff2017d65b1ddef384f8 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | New CVE Received | [email protected] |