CyberRota Analysis
AI-GeneratedFrontAccounting versions up to 2.4.20 are vulnerable due to the use of unsalted MD5 hashes for storing and verifying user passwords, making them susceptible to attacks using precomputed lookup tables and GPU cracking. This vulnerability allows an attacker with access to the user table to easily recover plaintext passwords. Organizations using this software should prioritize addressing this issue to enhance their password security and protect user credentials.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and update_user_password(), admin/change_current_user_password.php does the same when a user changes their own password, the forgotten-password path in includes/current_user.inc hashes the newly generated password the same way, and authentication calls get_user_auth($loginname, md5($password)). The codebase applies no per-password salt and contains no call to password_hash(), password_verify() or any other adaptive hash, so identical passwords yield identical digests and an attacker who obtains the user table can recover plaintext passwords with precomputed lookup tables or high-rate GPU cracking.