CyberRota Analysis
AI-GeneratedThe vulnerability affects the User Password Handler in the Java component of sfturing hosp_order, specifically within the MD5.getMD5 function, which generates a one-way hash without salt. This flaw could allow remote attackers to exploit the hashing mechanism, although the complexity of the attack is high and exploitability is considered difficult. Organizations using this software should prioritize remediation due to the potential risk of compromised password security, especially if they handle sensitive user data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssm_pro/src/main/java/cn/sfturing/utils/MD5.java of the component User Password Handler. The manipulation leads to one-way hash without salt. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.