CVE-2026-96550: sfturing hosp_order MailUtil.java getProperties cleartext transmission
A vulnerability was found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This issue affects the function getProperties of the file ssmpro/src/main/java/cn/sfturing/utils/MailUtil.java. Performing a manipulation results in cleartext transmission of sensitive information. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is assessed as difficult. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is most likely to be exposed to this issue?
Deployments of sfturing hosp_order containing the affected MailUtil.java getProperties implementation are potentially exposed, including remote attack paths. Because the project uses rolling releases and no affected or fixed release details are available, exposure cannot be determined from a version number alone.
What does an attacker need to exploit it?
The attack can be initiated remotely and does not require privileges or user interaction. However, the reported attack complexity is high and exploitability is assessed as difficult, despite a public exploit being available.
What should teams do if they cannot confirm a fix is available?
Review the deployed source or build artifacts for the getProperties function in ssm_pro/src/main/java/cn/sfturing/utils/MailUtil.java and assess whether its mail-related configuration can cause sensitive information to be transmitted without encryption. Monitor the project’s issue handling, since it was notified but had not responded at the time of reporting.