The vulnerability in sfturing hosp_order involves the use of MD5 hashing without incorporating a salt in the password handling function MD5.getMD5. This weakens the security of stored password hashes, potentially allowing attackers to perform precomputed hash attacks such as rainbow table lookups. The attack complexity is high and exploitability is difficult. The vulnerability can be triggered remotely. The product uses a rolling release model, so no fixed version is specified. The vendor has not provided a patch or response as of the publication date. Public exploit code is available but no active exploitation is reported.

The lack of salting in the MD5 hashing function reduces the effectiveness of password hashing, making it easier for attackers to perform offline attacks to recover passwords if they obtain the hash values. However, the attack complexity and exploit difficulty are high, and no known active exploitation is reported. The vulnerability affects the confidentiality of user passwords if hashes are exposed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are provided, users should monitor for updates from the vendor. Consider mitigating by implementing additional salting and stronger hashing algorithms in password handling until an official fix is available.