The vulnerability exists in the CommonUserController.java component of the sfturing hosp_order system, where an attacker can craft a request that is accepted as if it came from an authenticated user. This CSRF flaw allows the attacker to trigger privileged operations or modify data without the target user’s consent. The impact is the execution of unintended actions on behalf of a logged‑in user, potentially leading to data corruption, unauthorized state changes, or escalation of privileges within the application.

The affected product is sfturing hosp_order. The flaw is present in the code base up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. Because the project does not employ explicit versioning, any deployment built from the source tree before that commit is likely vulnerable. The exact product version cannot be ascertained, so all instances of hosp_order that have not applied a fix are assumed affected.

The CVSS score of 5.3 indicates a medium level of severity for the potential impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so there is no publicly recorded exploitation at the time of this analysis. The attack can be launched remotely by an attacker who can induce a victim to visit a crafted URL or form. While not capable of remote code execution, the exploitation path is straightforward for a determined adversary with access to the web application’s network or ability to socially engineer users.