Submeter #970935: SourceCodester Drug Recommendation System 1.0 Insufficiently Protected Credentials

An insufficiently protected credentials vulnerability exists in SourceCodester Drug Recommendation System 1.0. User passwords are stored in plaintext without hashing in Admin/add_user.php and Admin/change_password.php. Additionally Auth/user_login.php verifies passwords via direct SQL string comparison rather than password_verify(). The same plaintext password is also sent to the user via email on registration in Auth/otp.php. This is inconsistent with Auth/add_student.php which correctly uses password_hash().

Vulnerable code:
Admin/add_user.php line 33: INSERT INTO users (name, email, password, role) VALUES ('$name', '$email', '$password', '$role')
Admin/change_password.php line 40: UPDATE users SET password = ? WHERE id = ? bound with plaintext new password
Auth/user_login.php line 9: SELECT * FROM users WHERE email = '$email' AND password = '$password' AND status = 1
Auth/otp.php line 61: ...Password: <strong>$password</strong>... sent via email

Proof of Concept:
1. POST /Admin/add_user.php with btnadd=1&txtname=TestUser&txtpassword=MySecretPass123&cmdrole=Doctor&[email protected] (admin session required)
2. POST /Auth/user_login.php with btnlogin=1&[email protected]&txtpassword=MySecretPass123 returns successful login
3. If DB is dumped via the SQL injection vulnerabilities: SELECT email, password FROM users returns all credentials in plaintext.

Impact: An attacker who obtains database access (e.g. via the SQL injection endpoints) immediately reads all user passwords. No protection against rainbow tables or password reuse attacks. CWE-256, CVSS v3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

• Utilizador: swj99557271 (UID 101148)
• Submissão: 10/09/2026 05h51 (há 25 dias)
• Moderação: 04/10/2026 10h51 (24 days later)
• Estado: Aceite
• Entrada VulDB: 413411 [SourceCodester Drug Recommendation System 1.0 Password Admin/add_user.php password Encriptação fraca]
• Pontos: 20