The vulnerability (CVE-2026-96552) affects the sfturing hosp_order project up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. It resides in the MD5.getMD5 function of ssm_pro/src/main/java/cn/sfturing/utils/MD5.java within the User Password Handler component. The flaw is the use of an unsalted one-way hash (MD5), which can reduce password security. The attack vector is network-based with high attack complexity and low privileges required. Exploitation does not require user interaction. Although exploit code is publicly available, the difficulty of exploitation and low impact limit the threat. The project uses a rolling release model, so no discrete affected versions or patches are identified. The maintainers have not yet responded to the vulnerability report.

The vulnerability allows remote attackers to exploit the use of an unsalted MD5 hash for password handling, potentially weakening password security. However, the impact is limited to low confidentiality loss with no integrity or availability impact. The exploitability is difficult, and no known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project uses a rolling release model and no response from maintainers is available, users should monitor for updates that address the use of unsalted hashes in the User Password Handler. Until a fix is provided, consider additional compensating controls such as enforcing strong passwords or using external authentication mechanisms.