A flaw exists in the sfturing hosp_order application that hard-codes database credentials in the jdbc.properties file. This allows an attacker to read the file and discover valid authentication information, potentially granting full administrative access to the backing database. The vulnerability is classified as a credential compromise (CWE-259 and CWE-798), and the official description states that an attacker can initiate the attack remotely, with the attack complexity rated as high but exploitability deemed difficult. The exploit is currently published and could be used by anyone with access to the application file.

The affected product is sfturing hosp_order, throughout all releases up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. No specific version numbers are published because the project uses a rolling release model. The vulnerable component is the file ssm_pro/src/main/resources/jdbc.properties, where the credentials are hard-coded.

With a CVSS score of 6.3 the vulnerability is considered moderate to high severity. The EPSS score is not available and the issue is not listed in CISA's KEV catalog, indicating no widespread exploitation data at this time. Although the official description notes high attack complexity, the presence of a published exploit lowers the real‑world risk for organizations that deploy the software without remediation. The likely attack vector involves remote access to the application’s configuration files, followed by credential extraction and subsequent unauthorized database access.