| शीर्षक | SH3 Informática Ltda Módulo de Gestão, Módulo de Arrecadação <2026.0.2.0 Storing Passwords in a Recoverable Format |
|---|
| विवरण | SH3 before version 2026.0.2.0 stored user credentials using a reversible password storage mechanism based on a XOR operation with a fixed embedded key, instead of a salted one-way password hashing function. An attacker with access to the application database, database backups, or equivalent stored credential material could recover user passwords in plaintext, potentially enabling account takeover and credential reuse attacks. The issue was fixed in version 2026.0.2.0, released in September 2026, by replacing the reversible mechanism with a salted one-way hashing process. The update requires manual deployment by affected customers. SH3 was contacted about the assessment for coordinated disclosure and reply stating that the vulnerability was fixed on version 2026.0.2.0. |
|---|
| स्रोत | ⚠️ https://medium.com/@warlleyfreire/sh3-public-management-system-stored-user-credentials-using-a-reversible-xor-based-mechanism-6aa3793804a2?postPublishedType=initial |
|---|
| उपयोगकर्ता | 0x5ea3o1f (UID 89513) |
|---|
| सबमिशन | 24/09/2026 12:28 AM (1 महीना पहले) |
|---|
| संयम | 24/10/2026 11:30 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 426138 [SH3 सामने 2026.0.2.0 Módulo de Gestão/Módulo de Arrecadação कमजोर एन्क्रिप्शन] |
|---|
| अंक | 20 |
|---|