Executive brief
sfturing hosp_order is a hospital appointment booking system written in Java. A reflected cross-site scripting vulnerability in public search pages allows an attacker to craft malicious URLs that execute JavaScript in a user's browser when visited. An attacker can steal session data, modify displayed appointment information, or perform unauthorized actions on behalf of the user without requiring authentication.
Technical details
The vulnerability exists in HospitalController, DoctorController, and OfficeController which copy HTTP request parameters into JSP templates without HTML encoding. JSP pages render these values directly in input element attributes using unescaped expression language (${commonCondition.hospitalName}), allowing attribute injection with event handler payloads. The attack requires no authentication or user interaction beyond opening a crafted URL, and exploits the application's origin to access session data and perform same-origin requests.
Affected products
- sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8
Timeline
- 2026-07-22: disclosed
- 2026-09-22: advisory