Submeter #720129: badaso 2.9.7 Cryptographically Weak PRNG

Vulnerability Files:

File

Function/Line

Issue

src/Controllers/BadasoAuthController.php

forgetPassword() Line 387

Weak random token generation

src/Controllers/BadasoAuthController.php

verify() Lines 61, 119

Weak verification token

src/Controllers/BadasoAuthController.php

reRequestVerification() Lines 227, 501, 605

Weak token reuse

src/Controllers/BadasoAuthController.php

resetPassword() Lines 428-471

No token expiration check

Description:

A critical authentication bypass vulnerability exists in Badaso ≤ 2.9.7. The password reset functionality uses PHP's cryptographically insecure rand() function to generate 6-digit verification tokens. Combined with the absence of token expiration checks and rate limiting, this allows remote attackers to brute-force password reset tokens and take over any user account.

• Fonte: ⚠️ https://note-hxlab.wetolink.com/share/HG1CWbb7FVnq
• Utilizador: hiro (UID 93548)
• Submissão: 19/12/2025 19h57 (há 6 meses)
• Moderação: 31/12/2025 15h46 (12 days later)
• Estado: Aceite
• Entrada VulDB: 339207 [Uasoft badaso até 2.9.7 Token BadasoAuthController.php forgetPassword Elevação de Privilégios]
• Pontos: 20