| शीर्षक | linlinjava litemall v1.8.0 CWE-307 |
|---|
| विवरण | Admin Login Brute-Force Vulnerability (CWE-307)
The /admin/auth/login endpoint lacks any anti-automation protections. Captcha verification is entirely commented out in both the frontend and backend; the captcha is generated
but never validated. Consecutive failed login attempts are never counted, locked, or rate-limited by IP or account. An attacker can therefore perform unlimited
credential-guessing attempts against the admin panel without any obstacle. Combined with the seeded default credentials (admin123/admin123), this enables trivial account takeover
or sustained online password brute-forcing. Severity: Medium, rising to High when default passwords remain unchanged. |
|---|
| स्रोत | ⚠️ https://github.com/linlinjava/litemall/issues/584 |
|---|
| उपयोगकर्ता | s1mple_xy (UID 82894) |
|---|
| सबमिशन | 12/09/2026 11:50 AM (24 दिन पहले) |
|---|
| संयम | 04/10/2026 06:10 PM (22 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 413449 [linlinjava litemall तक 1.8.0 Login Endpoint AdminAuthController.java सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|