A flaw in the sfturing hosp_order system allows an attacker to compute user passwords from stored hashes because the application uses a plain MD5 hash without any salt. This weak cryptographic practice enables the attacker to perform pre‑computed or brute‑force attacks far more cheaply than one would expect for a salted hash. The CVE notes that an attacker can initiate the exploit remotely, but the overall difficulty is high and a publicly available exploit exists.

The vulnerability affects the sfturing hosp_order platform, specifically in the User Password Handler component located at ssm_pro/src/main/java/cn/sfturing/utils/MD5.java. All releases before commit 627f426331da8086ce8fff2017d65b1ddef384f8 are impacted. Because the project operates on a rolling release model, no fixed version numbers are currently published.

The CVSS score of 2.3 indicates a low impact rating, and the EPSS score is not available, suggesting limited known exploitation activity. The vulnerability is not listed in the CISA KEV catalog. Nonetheless, the presence of unsalted MD5 hash makes the system vulnerable to credential compromise, particularly if user passwords are weak. Even though the attack requires high technical effort and a public exploit is noted, the potential impact on confidentiality is non‑trivial because stolen passwords could be reused across services. The overall risk remains moderate to low, but organizations should treat this as a known weakness that may be exploited in the future.