CVE-2026-86264: sfturing ssm_pro XSS Vulnerability

CVE-2026-86264 Overview

CVE-2026-86264 is a cross-site scripting (XSS) vulnerability in the sfturing ssm_pro project, a Java-based hospital order management application. The flaw resides in the Order Endpoint implemented in ssm_pro/src/main/java/cn/sfturing/web/OrderController.java. Attackers can manipulate the hospitalName, officesName, or doctorName parameters to inject arbitrary script content. The vulnerability is remotely reachable and requires user interaction to trigger. The issue affects ssm_pro up to commit 627f426331da8086ce8fff2017d65b1ddef384f8, and a public exploit has been disclosed. The project maintainer was notified through a GitHub issue but has not yet responded.

Critical Impact
Remote attackers can inject arbitrary JavaScript into the Order Endpoint via unsanitized order-related parameters, enabling session theft, phishing, and browser-based actions in the victim's context.

Affected Products

sfturing ssm_pro up to commit 627f426331da8086ce8fff2017d65b1ddef384f8
Component: Order Endpoint (OrderController.java)
Vulnerable parameters: hospitalName, officesName, doctorName

Discovery Timeline

2026-09-07 - CVE-2026-86264 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86264

Vulnerability Analysis

The vulnerability is a reflected or stored cross-site scripting (XSS) flaw classified under [CWE-79]. The application accepts the hospitalName, officesName, and doctorName request parameters and renders them back to users without proper output encoding or input validation. An attacker who convinces a user to interact with a crafted request causes attacker-controlled markup or JavaScript to execute in the victim's browser session.

Because ssm_pro is a hospital order management system, successful exploitation can expose patient-facing or administrator-facing views. Consequences include session cookie theft, credential harvesting through injected forms, unauthorized order actions performed as the victim, and pivoting to internal administrative interfaces. The project has not published a patch, and public exploit details are available through VulDB and the GitHub issue tracker.

Root Cause

The root cause is missing contextual output encoding in the Order Endpoint controller. Values received from HTTP request parameters flow into server-rendered responses without HTML entity encoding or allow-list validation. The controller trusts caller-supplied strings that are then embedded into HTML output.

Attack Vector

The attack vector is remote and requires user interaction. An attacker crafts a URL or form submission containing malicious script payloads in the hospitalName, officesName, or doctorName fields. When a user visits the crafted link or when the tainted data is later rendered in an order view, the browser executes the injected script within the application origin. See the VulDB vulnerability report for additional exploitation context.

Detection Methods for CVE-2026-86264

Indicators of Compromise

HTTP requests to Order Endpoint routes containing <script>, onerror=, javascript:, or encoded variants in hospitalName, officesName, or doctorName parameters.
Application logs showing order records with HTML tags or JavaScript event handlers stored in hospital, office, or doctor name fields.
Unexpected outbound connections from user browsers to attacker-controlled domains after loading order pages.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect Order Endpoint parameters for XSS payload signatures and encoded variants.
Review server access logs for anomalous parameter values on requests targeting OrderController routes.
Perform database audits for existing records containing script tags or HTML event attributes in name fields.

Monitoring Recommendations

Enable Content Security Policy (CSP) violation reporting to capture blocked inline script execution attempts.
Alert on repeated 4xx or 5xx responses from Order Endpoint routes originating from a single source address.
Correlate authentication events with order submissions containing suspicious character sequences.

How to Mitigate CVE-2026-86264

Immediate Actions Required

Restrict access to the ssm_pro Order Endpoint to trusted networks until a patch is available.
Deploy a WAF rule that blocks or sanitizes HTML control characters in hospitalName, officesName, and doctorName parameters.
Audit stored order data for injected script content and purge tainted entries.
Notify users of the application to avoid clicking untrusted links referencing the order interface.

Patch Information

No official patch is available. The maintainer of the sfturing/hosp_order repository has been notified through the GitHub Issue Discussion but has not responded. Organizations running ssm_pro should apply compensating controls and consider forking the project to implement output encoding in OrderController.java.

Workarounds

Implement server-side HTML entity encoding on all order-related name fields before rendering, using a library such as OWASP Java Encoder.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Apply input validation that rejects characters such as <, >, ", ', and & in fields that should contain only plain text.
Set the HttpOnly and Secure flags on session cookies to reduce session theft impact from injected scripts.

bash

# Example Content-Security-Policy header for Spring MVC applications
# Add to a security filter or web.xml response header configuration
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'