| Title | SH3 Informática Ltda Módulo de Gestão, Módulo de Arrecadação <2026.0.2.0 Storing Passwords in a Recoverable Format |
|---|
| Description | SH3 before version 2026.0.2.0 stored user credentials using a reversible password storage mechanism based on a XOR operation with a fixed embedded key, instead of a salted one-way password hashing function. An attacker with access to the application database, database backups, or equivalent stored credential material could recover user passwords in plaintext, potentially enabling account takeover and credential reuse attacks. The issue was fixed in version 2026.0.2.0, released in September 2026, by replacing the reversible mechanism with a salted one-way hashing process. The update requires manual deployment by affected customers. SH3 was contacted about the assessment for coordinated disclosure and reply stating that the vulnerability was fixed on version 2026.0.2.0. |
|---|
| Source | ⚠️ https://medium.com/@warlleyfreire/sh3-public-management-system-stored-user-credentials-using-a-reversible-xor-based-mechanism-6aa3793804a2?postPublishedType=initial |
|---|
| User | 0x5ea3o1f (UID 89513) |
|---|
| Submission | 09/24/2026 00:28 (1 month ago) |
|---|
| Moderation | 10/24/2026 23:30 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 426138 [SH3 prior 2026.0.2.0 Módulo de Gestão/Módulo de Arrecadação weak password hash] |
|---|
| Points | 20 |
|---|