| शीर्षक | Webkul Aureuserp v1.6.0 Weak Password Requirements |
|---|
| विवरण | AureusERP v1.6.0 is affected by a weak password policy in the user creation functionality, where newly created accounts are protected only by a minimum password length requirement of eight characters. The application does not enforce additional password-strength requirements such as mixed uppercase and lowercase characters, numbers, or special characters. This allows administrators to create accounts using highly predictable passwords like 12345678 or other commonly used credentials. The validation is implemented in plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php, where the password field applies only a min:8 rule. As a result, passwords that meet the minimum length but are trivial to guess can be successfully assigned to user accounts and subsequently used for authentication. If an attacker can identify a valid account username or email address, they may be able to perform credential-guessing or dictionary attacks against the account, potentially resulting in unauthorized access and access to the data and functionality available to the compromised user.
Researcher - 1
Name: Karan Parelkar
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/KaranParelkar
LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/
Researcher - 2
Name: Devansh Sanghvi
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/Devansh10845
LinkedIn: https://www.linkedin.com/in/devansh-sanghvi-16570325b/ |
|---|
| स्रोत | ⚠️ https://github.com/KaranParelkar/Auresus_vulnerability/blob/main/Weak%20Password%20Policy/Readme.md |
|---|
| उपयोगकर्ता | Devansh33 (UID 101178) |
|---|
| सबमिशन | 11/09/2026 03:29 PM (1 महीना पहले) |
|---|
| संयम | 19/10/2026 11:28 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 422296 [Webkul Aureus ERP तक 1.6.0 UserForm.php password कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|