An insecure password recovery feature in sfturing hosp_order’s CommonUserController allows an attacker to change a user’s password without proper authentication. The modifyPassWord function can be manipulated so that any account can have its password set to an attacker‑chosen value, effectively hijacking the account. This flaw permits unauthorized system access from outside the network.

The affected application is sfturing hosp_order, a web-based hospital order system. The vulnerability affects all releases up to commit 627f426331da8086ce8fff2017d65b1ddef384f8, and because the project follows a rolling release model, specific version numbers are not provided. A patch has not yet been published and no official fix is available.

The CVSS score of 6.9 categorizes the issue as moderate severity, while the lack of an EPSS score and its absence from the KEV catalogue imply uncertain but potentially low to moderate exploitation likelihood, despite a publicly available exploit. Based on the description, it is inferred that the attacker can trigger the flaw by sending crafted HTTP requests to the modifyPassWord endpoint of the password recovery API, which does not verify the user’s credential before allowing a password change. This permits a remote attacker to take over any account without requiring additional privileges. Until a vendor release is issued, the risk remains significant for exposed services.