This vulnerability in sfturing hosp_order involves a cross-site request forgery (CSRF) flaw in an unspecified function of the CommonUserController.java source file. The vulnerability can be exploited remotely without privileges or user interaction beyond the victim visiting a malicious site. The product lacks versioning, so affected versions cannot be precisely determined. The vulnerability was publicly disclosed, but the vendor has not issued a patch or official response. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, low impact on integrity, and no impact on confidentiality or availability.

Successful exploitation allows remote attackers to perform unauthorized actions on behalf of authenticated users via CSRF. This can lead to unintended operations being executed without the user's consent. The impact is limited to integrity and requires user interaction, with no direct confidentiality or availability impact reported.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should apply general CSRF mitigations such as implementing anti-CSRF tokens and validating the origin of requests if possible. Monitor vendor channels for updates or patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.