CVE-2025-6766: Sfturing Hosp Order SQLi Vulnerability

CVE-2025-6766 Overview

CVE-2025-6766 is a SQL injection vulnerability in the sfturing/hosp_order application, a hospital order management project distributed via GitHub. The flaw resides in the getOfficeName function within OfficeServiceImpl.java, where the officesName argument is concatenated into a database query without proper sanitization. Remote authenticated attackers can manipulate this parameter to inject arbitrary SQL statements. The project uses a rolling release model, so no fixed version is published. The exploit details have been disclosed publicly through VulDB and the project's GitHub issue tracker, making opportunistic exploitation attempts possible.

Critical Impact
Remote attackers with low-privilege access can inject SQL through the officesName parameter, leading to unauthorized data access, modification, or disclosure of hospital order records.

Affected Products

sfturing hosp_order (rolling release, up to commit 627f426331da8086ce8fff2017d65b1ddef384f8)
OfficeServiceImpl.java component implementing getOfficeName
All deployments using the affected officesName query path

Discovery Timeline

2025-06-27 - CVE-2025-6766 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6766

Vulnerability Analysis

The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command) and [CWE-74] (Improper Neutralization of Special Elements in Output). It affects the getOfficeName method inside OfficeServiceImpl.java, a service-layer component that retrieves office records by name. The method accepts the officesName argument from upstream controllers and forwards it into an SQL query without parameterization or input validation. Attackers can append SQL syntax such as UNION-based payloads, boolean conditions, or stacked queries through this parameter. The attack vector is remote over the network and requires only low-privileged authenticated access. Exploitation does not require user interaction or elevated privileges. The EPSS probability is 0.315%, indicating low but measurable exploitation likelihood. Public disclosure increases the risk of automated scanning against exposed instances of the application.

Root Cause

The root cause is the construction of SQL statements via string concatenation rather than prepared statements or parameterized queries. The officesName input flows directly into the query body, bypassing any input sanitization layer. The MyBatis or JDBC binding in use does not enforce typed parameter substitution for this code path.

Attack Vector

An attacker sends an HTTP request to the endpoint that invokes getOfficeName, supplying a crafted officesName value containing SQL metacharacters. The injected payload alters the original query logic, allowing the attacker to read or modify arbitrary database content accessible to the application's database user. No local access or special privileges are needed beyond standard application authentication.

No verified proof-of-concept code is included here. Refer to the GitHub Issue Discussion and VulDB #314080 for disclosed technical details.

Detection Methods for CVE-2025-6766

Indicators of Compromise

HTTP requests to office-related endpoints containing SQL metacharacters such as ', --, UNION SELECT, or OR 1=1 within the officesName parameter.
Database logs showing malformed queries originating from the getOfficeName code path or unexpected SELECT statements against unrelated tables.
Application error responses or stack traces referencing OfficeServiceImpl.java triggered by crafted input.

Detection Strategies

Inspect web server and application access logs for anomalous officesName query string values containing encoded SQL syntax.
Enable verbose database query logging and correlate query patterns with authenticated user sessions to identify deviations from baseline office lookup behavior.
Deploy a web application firewall rule set tuned to detect SQL injection signatures targeting the office lookup endpoint.

Monitoring Recommendations

Monitor outbound database response sizes from the getOfficeName endpoint for sudden growth, which can indicate data exfiltration via UNION-based injection.
Alert on authentication-followed-by-injection patterns where low-privilege accounts issue rapid sequential queries with suspicious payloads.
Track failed query exceptions in application logs that reference the affected service class.

How to Mitigate CVE-2025-6766

Immediate Actions Required

Audit the getOfficeName method in OfficeServiceImpl.java and replace string-concatenated SQL with parameterized queries or prepared statements.
Restrict access to the hosp_order application to trusted internal networks until a patched commit is deployed.
Apply input validation to enforce an allow-list character set on the officesName parameter at the controller layer.
Review database account permissions used by the application and apply least-privilege principles to limit blast radius.

Patch Information

The project follows a rolling release model with no formal version tagging. No vendor-issued patch advisory is available at the time of publication. Track the GitHub Issue Discussion for upstream remediation and rebuild from the latest commit once a fix is merged.

Workarounds

Place a web application firewall in front of the application with rules blocking SQL injection signatures on the office lookup endpoint.
Disable or remove the affected office name search functionality if it is not required for production workflows.
Enforce database user separation so the application connects with a read-only account where possible.

bash

# Configuration example - WAF rule pattern for blocking SQL injection on officesName
# ModSecurity rule sketch (review and tune before production use)
SecRule ARGS:officesName "@detectSQLi" \
    "id:1006766,phase:2,deny,status:403,\
     msg:'Potential SQL injection targeting CVE-2025-6766 (hosp_order officesName)'"