POST /orderUserCenter accepts userID , id , and diseaseInfo from the client and performs appointment-state updates without authenticating the caller or checking that the appointment belongs to the specified user. It also loads and renders the specified user's submitted appointment list.
Commit 627f426331da8086ce8fff2017d65b1ddef384f8 .
Unverified Ownership (CWE-639).
ssm_pro/src/main/java/cn/sfturing/web/OrderController.java:97-115
ssm_pro/src/main/resources/mapper/OrderRecordsDao.xml:40-50
ssm_pro/src/main/webapp/WEB-INF/jsp/userCenter/userCenter.jsp:70-108
The handler takes both ownership-relevant identifiers from the form request and performs the updates before any session-dependent code:
The MyBatis statements use only WHERE id = #{id} . No query binds the current user to the target appointment.
Set TARGET_USER_ID and TARGET_ORDER_ID to records created in a local test deployment. Do not send a session cookie.
The handler marks TARGET_ORDER_ID as submitted, replaces its disease information, and returns the order-center page containing the appointment data associated with TARGET_USER_ID .
The controller-level proof ran this route with MockHttpSession containing no user and produced:
Any unauthenticated user can alter an arbitrary appointment's workflow state and medical text and can obtain another user's appointment metadata. This permits appointment fraud, integrity loss, and disclosure of health-service activity.
Require an authenticated subject. Load the appointment by ID and authenticated user ID in a single authorization-aware query, reject mismatches, and ignore any user ID supplied by the client. Validate state transitions server-side.
Score: 8.2 (High) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
