Submit #720129: badaso 2.9.7 Cryptographically Weak PRNG

Vulnerability Files:

File

Function/Line

Issue

src/Controllers/BadasoAuthController.php

forgetPassword() Line 387

Weak random token generation

src/Controllers/BadasoAuthController.php

verify() Lines 61, 119

Weak verification token

src/Controllers/BadasoAuthController.php

reRequestVerification() Lines 227, 501, 605

Weak token reuse

src/Controllers/BadasoAuthController.php

resetPassword() Lines 428-471

No token expiration check

Description:

A critical authentication bypass vulnerability exists in Badaso ≤ 2.9.7. The password reset functionality uses PHP's cryptographically insecure rand() function to generate 6-digit verification tokens. Combined with the absence of token expiration checks and rate limiting, this allows remote attackers to brute-force password reset tokens and take over any user account.

• Source: ⚠️ https://note-hxlab.wetolink.com/share/HG1CWbb7FVnq
• User: hiro (UID 93548)
• Submission: 12/19/2025 19:57 (6 months ago)
• Moderation: 12/31/2025 15:46 (12 days later)
• Status: Accepted
• VulDB entry: 339207 [Uasoft badaso up to 2.9.7 Token BadasoAuthController.php forgetPassword password recovery]
• Points: 20