Executive brief
sfturing hosp_order is a hospital appointment scheduling system. The application fails to verify user identity when processing appointment modifications, allowing unauthenticated attackers to alter other users' appointments, change medical information, and access sensitive health-related appointment data without permission.
Technical details
The vulnerability is an authentication and authorization bypass (CWE-639) in the OrderController's updateOrderSta1 and updateOrderdiseaseInfo functions. The vulnerable code accepts userID and order ID parameters directly from unauthenticated POST requests to /orderUserCenter and performs database updates without validating that the current user owns the target appointment. The MyBatis queries use only WHERE id = #{id}, binding neither the authenticated user nor checking ownership before updating state or disease information. An unauthenticated attacker can craft HTTP POST requests with arbitrary userID and order ID values to modify appointments and retrieve another user's appointment metadata. No patch is currently available; the project maintainers have not responded to the early disclosure.
Affected products
- sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8
Timeline
- 2026-07-22: disclosed: Vulnerability reported via GitHub issue #115
- 2026-09-07: advisory: CVE-2026-86262 published