| タイトル | SourceCodester Drug Recommendation System 1.0 Insufficiently Protected Credentials |
|---|
| 説明 | An insufficiently protected credentials vulnerability exists in SourceCodester Drug Recommendation System 1.0. User passwords are stored in plaintext without hashing in Admin/add_user.php and Admin/change_password.php. Additionally Auth/user_login.php verifies passwords via direct SQL string comparison rather than password_verify(). The same plaintext password is also sent to the user via email on registration in Auth/otp.php. This is inconsistent with Auth/add_student.php which correctly uses password_hash().
Vulnerable code:
Admin/add_user.php line 33: INSERT INTO users (name, email, password, role) VALUES ('$name', '$email', '$password', '$role')
Admin/change_password.php line 40: UPDATE users SET password = ? WHERE id = ? bound with plaintext new password
Auth/user_login.php line 9: SELECT * FROM users WHERE email = '$email' AND password = '$password' AND status = 1
Auth/otp.php line 61: ...Password: <strong>$password</strong>... sent via email
Proof of Concept:
1. POST /Admin/add_user.php with btnadd=1&txtname=TestUser&txtpassword=MySecretPass123&cmdrole=Doctor&[email protected] (admin session required)
2. POST /Auth/user_login.php with btnlogin=1&[email protected]&txtpassword=MySecretPass123 returns successful login
3. If DB is dumped via the SQL injection vulnerabilities: SELECT email, password FROM users returns all credentials in plaintext.
Impact: An attacker who obtains database access (e.g. via the SQL injection endpoints) immediately reads all user passwords. No protection against rainbow tables or password reuse attacks. CWE-256, CVSS v3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
|
|---|
| ユーザー | swj99557271 (UID 101148) |
|---|
| 送信 | 2026年09月10日 05:51 (25 日 ago) |
|---|
| モデレーション | 2026年10月04日 10:51 (24 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 413411 [SourceCodester Drug Recommendation System 1.0 Password Admin/add_user.php password 弱い暗号化] |
|---|
| ポイント | 20 |
|---|