CVE-2026-96552

Deferred Deferred - Pending Action

Weak MD5 Hashing Without Salt in Sfturing Hosp Order

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: VulDB

Description

A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssm_pro/src/main/java/cn/sfturing/utils/MD5.java of the component User Password Handler. The manipulation leads to one-way hash without salt. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-96552

EUVD

EUVD-2026-85626

Affected Vendors & Products

Vendor	Product	Version / Range
sfturing	hosp_order	to 627f426331da8086ce8fff2017d65b1ddef384f8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-759	The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.
CWE-325	The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

Attack-Flow Graph

Executive Summary

This vulnerability involves the use of unsalted MD5 hashes for storing user passwords in the sfturing hosp_order application. The MD5.getMD5 function in MD5.java generates a deterministic 32-character hash without adding a unique salt per password, making it vulnerable to cracking attacks. An attacker with database access could use rainbow tables or password dictionaries to reverse-engineer the original passwords.

Detection Guidance

Check if user passwords are stored as unsalted MD5 hashes in the database by querying the user_password column in the commonuser table. Look for 32-character hexadecimal strings in the ssm_pro/src/main/java/cn/sfturing/utils/MD5.java file for MD5.getMD5 function usage.

Impact Analysis

If an attacker gains access to the database, they can crack unsalted MD5 password hashes and obtain plaintext passwords. This could lead to unauthorized account access, potential data breaches, and compromise of other services where users reuse passwords. The impact is higher if users reuse passwords across multiple platforms.

Compliance Impact

This vulnerability likely violates data protection requirements under GDPR and HIPAA, which mandate secure storage of sensitive data like passwords. Using unsalted MD5 hashes fails to meet modern security standards and could result in non-compliance, leading to legal penalties, fines, or reputational damage for organizations handling user data.

Mitigation Strategies

Replace MD5 with a modern hashing algorithm like Argon2id, bcrypt, or PBKDF2. Add unique salts per password and migrate hashes after successful logins. Invalidate credentials as part of incident response.

Hi! I’m here to help you understand CVE-2026-96552. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70