| 标题 | NovoSGA 2.2.12 Weak Password Requirements |
|---|
| 描述 | ## Summary
A **Weak Password Policy** vulnerability was identified in the user registration functionality of the _Novosga_ application. This vulnerability allows the creation of accounts with extremely weak and predictable passwords, such as `123456`. This exposes the platform to brute-force and credential stuffing attacks.
---
## Details
**Vulnerable Component:** User registration / password creation
The application fails to enforce a strong password policy. As a result, users can register accounts with trivial and well-known weak passwords, compromising the authentication security of the platform.
---
## PoC
1. Navigate to the user registration page after logged in with the Administrator account
![[Pasted image 20250928002128.png]]
2. Create a new user account with the password `123456`.
![[Pasted image 20250928002354.png]]
```
```
3. The application accepts the weak password without restrictions and creates the account successfully.
![[Pasted image 20250928002428.png]]
---
## Impact
Weak password policy vulnerabilities can have significant consequences, including:
- Increased risk of brute-force and credential stuffing attacks
- Unauthorized access to user or administrative accounts
- Privilege escalation through compromised accounts
- Reduced overall security posture of the application
### **Mitigation**
- Enforce strong password policies (minimum length, use of uppercase, lowercase, digits, and special characters).
- Prevent the use of commonly known weak passwords (e.g., via blocklists such as “123456”, “password”, “qwerty”).
- Encourage or enforce multi-factor authentication (MFA) to mitigate the risk of compromised weak passwords.
- Implement rate-limiting or account lockout mechanisms to slow down brute-force attempts. |
|---|
| 来源 | ⚠️ https://github.com/marcelomulder/CVE/blob/main/NovoSga/Weak%20Password%20Policy%20in%20Novosga.md |
|---|
| 用户 | marceloQz (UID 87549) |
|---|
| 提交 | 2025-09-28 06時04分 (1 年前) |
|---|
| 管理 | 2025-10-05 08時41分 (7 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 327203 [Mangati NovoSGA 直到 2.2.12 User Creation Page /novosga.users/new Senha/Confirmação da senha 弱身份验证] |
|---|
| 积分 | 20 |
|---|