| 제목 | Webkul Aureuserp v1.6.0 Weak Password Requirements |
|---|
| 설명 | AureusERP v1.6.0 is affected by a weak password policy in the user creation functionality, where newly created accounts are protected only by a minimum password length requirement of eight characters. The application does not enforce additional password-strength requirements such as mixed uppercase and lowercase characters, numbers, or special characters. This allows administrators to create accounts using highly predictable passwords like 12345678 or other commonly used credentials. The validation is implemented in plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php, where the password field applies only a min:8 rule. As a result, passwords that meet the minimum length but are trivial to guess can be successfully assigned to user accounts and subsequently used for authentication. If an attacker can identify a valid account username or email address, they may be able to perform credential-guessing or dictionary attacks against the account, potentially resulting in unauthorized access and access to the data and functionality available to the compromised user.
Researcher - 1
Name: Karan Parelkar
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/KaranParelkar
LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/
Researcher - 2
Name: Devansh Sanghvi
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/Devansh10845
LinkedIn: https://www.linkedin.com/in/devansh-sanghvi-16570325b/ |
|---|
| 원천 | ⚠️ https://github.com/KaranParelkar/Auresus_vulnerability/blob/main/Weak%20Password%20Policy/Readme.md |
|---|
| 사용자 | Devansh33 (UID 101178) |
|---|
| 제출 | 2026. 09. 11. PM 03:29 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 19. AM 11:28 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 422296 [Webkul Aureus ERP 까지 1.6.0 UserForm.php password 약한 인증] |
|---|
| 포인트들 | 20 |
|---|