Отправить #720129: badaso 2.9.7 Cryptographically Weak PRNG

Vulnerability Files:

File

Function/Line

Issue

src/Controllers/BadasoAuthController.php

forgetPassword() Line 387

Weak random token generation

src/Controllers/BadasoAuthController.php

verify() Lines 61, 119

Weak verification token

src/Controllers/BadasoAuthController.php

reRequestVerification() Lines 227, 501, 605

Weak token reuse

src/Controllers/BadasoAuthController.php

resetPassword() Lines 428-471

No token expiration check

Description:

A critical authentication bypass vulnerability exists in Badaso ≤ 2.9.7. The password reset functionality uses PHP's cryptographically insecure rand() function to generate 6-digit verification tokens. Combined with the absence of token expiration checks and rate limiting, this allows remote attackers to brute-force password reset tokens and take over any user account.

• Источник: ⚠️ https://note-hxlab.wetolink.com/share/HG1CWbb7FVnq
• Пользователь: hiro (UID 93548)
• Представление: 19.12.2025 19:57 (10 месяцы назад)
• Модерация: 31.12.2025 15:46 (12 days later)
• Статус: принято
• Запись VulDB: 339207 [Uasoft badaso до 2.9.7 Token BadasoAuthController.php forgetPassword эскалация привилегий]
• Баллы: 20