An unauthenticated authorization bypass in the sfturing hosp_order component allows remote attackers to manipulate medical appointment data and access sensitive user information.

This vulnerability is an authorization bypass (CWE-639) located in the OrderController.java file, where the application fails to verify ownership or session context when processing POST requests to the /orderUserCenter endpoint. An unauthenticated attacker can supply arbitrary userID and order ID parameters to modify appointment states and retrieve private medical metadata.

The ability for unauthenticated parties to modify appointment workflows and access private health-service activity poses a severe risk to data integrity and patient confidentiality. With a CVSS score of 7.3, this flaw facilitates unauthorized access to sensitive medical records, which can lead to significant reputational damage, regulatory non-compliance, and disruption of hospital operations.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the /orderUserCenter endpoint and evaluate the feasibility of implementing custom server-side authentication logic to validate session ownership before processing requests.

Proactive Monitoring: Monitor server access logs for anomalous POST requests to the /orderUserCenter endpoint, specifically tracking requests that lack valid session identifiers or originate from unexpected IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block requests to the vulnerable endpoint that do not contain valid, authenticated session tokens or that exhibit suspicious parameter patterns.

Public Exploit Available: Yes, a functional proof-of-concept exists and is documented in the project's public GitHub issue tracker (Issue #115).

Given the public availability of exploit details and the critical nature of the compromised data, immediate mitigation is required. Organizations utilizing this software must prioritize restricting public access to the affected components and monitor for signs of unauthorized data modification until a formal patch is released by the vendor.