CVE-2026-95396: sfturing hosp_order XSS Vulnerability

CVE-2026-95396 Overview

CVE-2026-95396 is a cross-site scripting (XSS) vulnerability [CWE-79] identified in the sfturing/hosp_order project up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. The flaw resides in an unspecified function within HospitalController.java, part of the Public Search Handlers component. Attackers can manipulate the Search argument to inject arbitrary script content that executes in a victim's browser session. The attack can be launched remotely and requires user interaction. A public exploit description exists, and the project maintainers have not responded to the disclosure issue.

Critical Impact
Remote attackers can inject malicious scripts through the public search functionality, enabling session data theft, credential harvesting, or unauthorized actions in the browser context of an authenticated user.

Affected Products

sfturing/hosp_order repository up to commit 627f426331da8086ce8fff2017d65b1ddef384f8
Component: Public Search Handlers (HospitalController.java)
No official versioning is published for this project

Discovery Timeline

2026-09-22 - CVE-2026-95396 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95396

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting issue in the search-handling logic of HospitalController.java. The controller accepts the Search request parameter and returns it in the HTTP response without proper output encoding or input sanitization. When a victim visits a crafted URL that includes attacker-controlled JavaScript in the Search parameter, the browser renders the payload as executable script within the application's origin. Because the vulnerability sits in a public search handler, no authentication is required to trigger the reflection. The disclosure notes that a public proof-of-concept exists and that the upstream project has not acknowledged the report submitted via GitHub Issue #118.

Root Cause

The root cause is missing output encoding of user-supplied input before it is written into an HTML response context. Java web frameworks require developers to apply context-appropriate escaping (for example, HTML entity encoding for body content) when reflecting request parameters. HospitalController.java passes the Search value directly into the rendered response, satisfying the conditions for [CWE-79] Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation follows the standard reflected XSS pattern. An attacker crafts a URL against the vulnerable search endpoint with a JavaScript payload in the Search query parameter and delivers it to a target via phishing, chat, or a malicious website. When the victim clicks the link, the server reflects the payload into the response HTML, and the browser executes it under the application's origin. Consequences include session cookie theft, forced actions against the hospital ordering workflow, and credential capture through injected forms. The vulnerability requires user interaction (UI:P) but no privileges (PR:N).

No verified proof-of-concept code is available in the enriched data. Refer to the GitHub Issue #118 and VulDB entry for CVE-2026-95396 for reported technical details.

Detection Methods for CVE-2026-95396

Indicators of Compromise

HTTP requests to hospital search endpoints containing <script>, javascript:, onerror=, or onload= tokens in the Search query parameter
URL-encoded XSS payloads such as %3Cscript%3E or %3Cimg%20src reaching the HospitalController search route
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after visiting a search URL
Referer headers on internal endpoints pointing to external phishing infrastructure

Detection Strategies

Deploy a web application firewall (WAF) rule that inspects the Search parameter for HTML tags, event handlers, and script schemes
Enable server access logging and alert on search query parameters containing angle brackets, quote characters, or common XSS keywords
Review browser Content Security Policy (CSP) violation reports for inline-script or event-handler blocks originating from the application

Monitoring Recommendations

Forward web server and application logs to a centralized analytics platform and build detections for suspicious search parameter values
Monitor for anomalous session-cookie access patterns or account activity following user visits to search URLs with unusual query strings
Track outbound DNS and HTTP telemetry from client workstations for beaconing that correlates with visits to the affected application

How to Mitigate CVE-2026-95396

Immediate Actions Required

Restrict public access to the hospital search endpoint via network controls or authentication until a fix is available
Deploy WAF signatures that block requests containing script tags or event-handler attributes in the Search parameter
Apply a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins
Educate users of the application to avoid clicking search links from untrusted sources

Patch Information

No official patch has been released. The maintainers of sfturing/hosp_order have not responded to the disclosure filed as GitHub Issue #118. Organizations running this codebase should apply local remediation by modifying HospitalController.java to HTML-encode the Search parameter before including it in any rendered response, using a vetted library such as OWASP Java Encoder. Track upstream progress through the project repository and the VulDB entry for CVE-2026-95396.

Workarounds

Apply server-side input validation that rejects search values containing <, >, ", ', or & characters
Wrap all reflected output from the search handler with an HTML entity encoder before writing to the response
Set HttpOnly and Secure flags on session cookies to reduce the impact of script-based cookie theft
Deploy a reverse proxy rule that strips or normalizes suspicious query parameters before they reach the application

bash

# Example ModSecurity rule to block reflected XSS payloads in the Search parameter
SecRule ARGS:Search "@rx (?i)(<script|javascript:|onerror=|onload=|<img[^>]+src)" \
    "id:1009539,phase:2,deny,status:403,log,\
    msg:'CVE-2026-95396 XSS payload detected in Search parameter'"