| 제목 | macrozheng mall 1.0.3 Cleartext Transmission of Sensitive Information |
|---|
| 설명 | mall v1.0.3, an e-commerce platform with over 81.1k stars on GitHub, is vulnerable to insecure transmission of user credentials. During the authentication process, plain passwords are submitted over unencrypted HTTP rather than HTTPS. Other APIs that require token authentication also use HTTP. This exposes sensitive information(i.e., Passwords and JWT Token) to interception by network-based attackers using packet sniffing or Man-in-the-Middle (MitM) attacks. Captured credentials can be reused to gain admin access, leading to Account Takeover. |
|---|
| 원천 | ⚠️ https://github.com/N1n3b9S/cve/issues/10 |
|---|
| 사용자 | Anonymous User |
|---|
| 제출 | 2025. 07. 26. AM 09:40 (9 개월 ago) |
|---|
| 모더레이션 | 2025. 08. 08. AM 10:50 (13 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 319237 [macrozheng mall 까지 1.0.3 /admin/login 약한 암호화] |
|---|
| 포인트들 | 20 |
|---|