An unauthenticated authorization bypass vulnerability in sfturing hosp_order allows remote attackers to manipulate patient records and exfiltrate sensitive personal information.

This is an authorization bypass (CWE-639) occurring in the OrderController component. The application fails to perform session validation, allowing an unauthenticated remote attacker to supply a victim identifier in the userIdenf parameter to perform unauthorized actions and disclose private patient data.

Successful exploitation of this vulnerability results in a significant breach of patient confidentiality and data integrity. Unauthorized actors can register fraudulent appointments and gain access to sensitive PII, including names, mobile numbers, and identity documents, which poses severe legal and reputational risks. While the provided CVSS score is 7.3, the researcher-calculated severity of 9.1 underscores the critical nature of this unauthorized access to sensitive healthcare records.

Immediate Action: As no official patch is currently available, restrict network access to the affected /order endpoint and implement strict input validation to ensure requests are tied to an authenticated session.

Proactive Monitoring: Monitor server access logs for anomalous POST requests to the /order endpoint that originate from unknown or suspicious IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing suspicious userIdenf patterns and enforce authentication requirements at the application gateway level.

Public Exploit Available: Yes, a functional proof-of-concept is documented in the GitHub issue tracker (https://github.com/sfturing/hosp_order/issues/114).

Due to the sensitive nature of the exposed patient data and the ease of exploitation, this vulnerability should be treated with high urgency. Administrators must prioritize restricting access to the vulnerable endpoint immediately, as the project maintainers have not yet provided an official software update to address the root cause.