| 标题 | SourceCodester Drug Recommendation System 1.0 Insufficiently Protected Credentials |
|---|
| 描述 | An insufficiently protected credentials vulnerability exists in SourceCodester Drug Recommendation System 1.0. User passwords are stored in plaintext without hashing in Admin/add_user.php and Admin/change_password.php. Additionally Auth/user_login.php verifies passwords via direct SQL string comparison rather than password_verify(). The same plaintext password is also sent to the user via email on registration in Auth/otp.php. This is inconsistent with Auth/add_student.php which correctly uses password_hash().
Vulnerable code:
Admin/add_user.php line 33: INSERT INTO users (name, email, password, role) VALUES ('$name', '$email', '$password', '$role')
Admin/change_password.php line 40: UPDATE users SET password = ? WHERE id = ? bound with plaintext new password
Auth/user_login.php line 9: SELECT * FROM users WHERE email = '$email' AND password = '$password' AND status = 1
Auth/otp.php line 61: ...Password: <strong>$password</strong>... sent via email
Proof of Concept:
1. POST /Admin/add_user.php with btnadd=1&txtname=TestUser&txtpassword=MySecretPass123&cmdrole=Doctor&[email protected] (admin session required)
2. POST /Auth/user_login.php with btnlogin=1&[email protected]&txtpassword=MySecretPass123 returns successful login
3. If DB is dumped via the SQL injection vulnerabilities: SELECT email, password FROM users returns all credentials in plaintext.
Impact: An attacker who obtains database access (e.g. via the SQL injection endpoints) immediately reads all user passwords. No protection against rainbow tables or password reuse attacks. CWE-256, CVSS v3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
|
|---|
| 用户 | swj99557271 (UID 101148) |
|---|
| 提交 | 2026-09-10 05時51分 (26 日前) |
|---|
| 管理 | 2026-10-04 10時51分 (24 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 413411 [SourceCodester Drug Recommendation System 1.0 Password Admin/add_user.php password 弱加密] |
|---|
| 积分 | 20 |
|---|