CVE-2026-96552: sfturing hosp_order User Password MD5.java MD5.getMD5 hash without salt
A vulnerability was identified in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssmpro/src/main/java/cn/sfturing/utils/MD5.java of the component User Password Handler. The manipulation leads to one-way hash without salt. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access would an attacker need to exploit this issue?
The attack can be initiated remotely, but it requires low privileges. Exploitation is considered difficult and requires a high degree of complexity.
Which component should be reviewed?
Review the User Password Handler, specifically the MD5.getMD5 function in ssm_pro/src/main/java/cn/sfturing/utils/MD5.java. The issue concerns password hashing performed without a salt.
Are fixed or affected release versions available?
No specific affected or fixed release versions are available because the product uses a rolling release model. The reported affected code state is up to commit 627f426331da8086ce8fff2017d65b1ddef384f8.
Is public exploit information available?
Yes. A public exploit is reported as available and might be used.
Has the project provided a response or remediation?
The project was notified through an issue report but had not responded at the time of the report. No vendor remediation is identified in the available data.