CVE-2026-96551

Deferred Deferred - Pending Action

Cross-Site Request Forgery in Sfturing Hosp Order

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: VulDB

Description

A vulnerability was determined in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Impacted is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java. Executing a manipulation can lead to cross-site request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-96551

EUVD

EUVD-2026-85617

Affected Vendors & Products

Vendor	Product	Version / Range
sfturing	hosp_order	to 627f426331da8086ce8fff2017d65b1ddef384f8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in the sfturing hosp_order application. It allows attackers to trick authenticated users into submitting malicious requests that change sensitive data like profile information or hospital favorites. The issue occurs because the application lacks CSRF protection for endpoints that modify user data.

Detection Guidance

To detect this CSRF vulnerability, inspect the application's endpoints for missing CSRF tokens or Spring Security configurations. Check for POST requests to /modifiPhone, /addUserInfo, /updateSex, or /favourite without token validation. Use browser developer tools to monitor network traffic for suspicious form submissions.

Impact Analysis

If you are a user of the affected application, an attacker could exploit this to change your profile details such as mobile number, identity information, or hospital preferences without your consent. This could disrupt account recovery, notifications, or compromise data integrity.

Compliance Impact

This vulnerability could lead to unauthorized data modifications, potentially violating GDPR's integrity and confidentiality principles or HIPAA's requirements for protecting patient data. Compliance may be impacted if sensitive user or patient information is altered without authorization.

Mitigation Strategies

Enable Spring Security CSRF protection in the application. Add CSRF tokens to all state-changing endpoints. Validate tokens server-side for /modifiPhone, /addUserInfo, /updateSex, and /favourite. Ensure proper session management and user input validation.

Hi! I’m here to help you understand CVE-2026-96551. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70