CVE-2022-45614
Summary
by MITRE • 01/10/2023
An issue in the /index.php/user/edit_user/ component of Book Store Management System v1.0 allows unauthenticated attackers to retrieve the password hashes of all existing user accounts via a crafted request.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified within the Book Store Management System version 1.0 represents a critical failure in server-side access control mechanisms, specifically targeting the /index.php/user/edit_user/ endpoint. This component is designed to handle updates to user profile information and typically requires authentication to ensure that only authorized individuals can modify their own data or administrative functions are performed securely. However, due to insufficient validation of session tokens and lack of proper authorization checks on the backend logic, an unauthenticated attacker can interact with this endpoint directly without valid credentials. This flaw effectively bypasses the intended security boundary, allowing external actors to execute operations that should be restricted to authenticated users only.
The core technical issue lies in the absence of robust identity verification before processing requests directed at user-specific data retrieval functions. When a crafted request is sent to this specific URI, the application fails to verify whether the requester possesses valid administrative privileges or legitimate session state associated with an existing account. Consequently, instead of returning an access denied error or redirecting to a login page, the server processes the query and returns sensitive information contained within the user database records. This behavior indicates that the backend logic treats all incoming requests as potentially authorized unless explicitly blocked by other means, which is a fundamental violation of secure design principles regarding privilege separation and data isolation.
The operational impact of this vulnerability is severe, primarily due to the exposure of password hashes for all existing user accounts. Password hashes are cryptographic representations of passwords that should remain confidential even if database access is compromised, as they provide a layer of protection against immediate plaintext credential theft. By retrieving these hashes, an attacker gains the ability to perform offline brute-force or dictionary attacks to reverse-engineer the original passwords. If users have employed weak or commonly used passwords across multiple services, this compromise extends beyond the Book Store Management System itself, leading to account takeover and potential lateral movement into other systems where those same credentials are reused. This scenario aligns with common attack patterns observed in real-world breaches involving credential stuffing and password cracking campaigns.
From a classification perspective, this vulnerability corresponds closely to CWE-284 Improper Access Control, as the system fails to restrict access to resources based on user identity or privileges. It also relates to CWE-522 Insufficiently Protected Credentials, given that sensitive authentication data is exposed without adequate encryption or masking during transmission and storage retrieval processes. In terms of adversary tactics, this exploitation method maps to MITRE ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials or bypass authentication entirely to gain initial access, followed by T1552 Unsecured Credentials if the hashes are successfully cracked to obtain plaintext passwords for further infiltration.
Mitigation strategies must focus on implementing strict server-side authorization checks at every endpoint that handles sensitive user data. Developers should ensure that all requests targeting user-specific resources verify both active session validity and appropriate role-based permissions before executing any database queries or returning responses. Additionally, employing parameterized queries and input validation can prevent secondary issues such as SQL injection which might exacerbate the impact of this flaw. It is also recommended to implement rate limiting on authentication-related endpoints to mitigate brute-force attempts resulting from hash exposure. Regular security audits and penetration testing should be conducted to identify similar access control weaknesses across other components of the application, ensuring a comprehensive defense-in-depth approach against unauthorized data retrieval attacks.