| tiêu đề | Soarkey StudentManagement e08f7f1d5015af407aa4cca0ada3dea189b4937e Cleartext Storage of Sensitive Information |
|---|
| Mô tả | The affected storage and processing paths are `建表代码.sql`, `code/src/dao/UserDao.java`, and `code/src/service/AdminDao.java`. The schema defines the `user` table with a raw `password char(12) not null` column and ships sample credentials such as `('admin','666','管理员')`. `UserDao.login()` at lines 39-68 compares submitted credentials against plaintext values, `UserDao.register()` at lines 71-86 stores the supplied password directly, `UserDao.query_all_user()` at lines 117-142 reads the raw password column, and `AdminDao.query_all_user()` at lines 105-126 writes each plaintext password into the HTTP response. This allows credentials to be recovered directly from the database and from application responses, enabling account takeover and password reuse attacks. |
|---|
| Nguồn | ⚠️ https://github.com/Soarkey/StudentManagement/issues/36 |
|---|
| Người dùng | gscsd (UID 97914) |
|---|
| Đệ trình | 30/09/2026 17:40 (cách đây 18 ngày) |
|---|
| Kiểm duyệt | 18/10/2026 00:22 (17 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 421658 [Soarkey StudentManagement đến e08f7f1d5015af407aa4cca0ada3dea189b4937e AdminDao.java UserDao.login password mã hóa yếu] |
|---|
| điểm | 20 |
|---|