| 제목 | linlinjava litemall v1.8.0 CWE-307 |
|---|
| 설명 | Admin Login Brute-Force Vulnerability (CWE-307)
The /admin/auth/login endpoint lacks any anti-automation protections. Captcha verification is entirely commented out in both the frontend and backend; the captcha is generated
but never validated. Consecutive failed login attempts are never counted, locked, or rate-limited by IP or account. An attacker can therefore perform unlimited
credential-guessing attempts against the admin panel without any obstacle. Combined with the seeded default credentials (admin123/admin123), this enables trivial account takeover
or sustained online password brute-forcing. Severity: Medium, rising to High when default passwords remain unchanged. |
|---|
| 원천 | ⚠️ https://github.com/linlinjava/litemall/issues/584 |
|---|
| 사용자 | s1mple_xy (UID 82894) |
|---|
| 제출 | 2026. 09. 12. AM 11:50 (23 날 ago) |
|---|
| 모더레이션 | 2026. 10. 04. PM 06:10 (22 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 413449 [linlinjava litemall 까지 1.8.0 Login Endpoint AdminAuthController.java 정보 공개] |
|---|
| 포인트들 | 20 |
|---|