-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from two key issues: 1) Use of MD5 for password hashing, and 2) Exposure of these hashes through database backups. The get_user_auth function was vulnerable because it implemented authentication using MD5 hash comparisons, making credential cracking feasible. The update_admin_password function (called in create_coy.php) was vulnerable because it generated and stored MD5 hashes during admin account creation. These functions were explicitly modified in the patch (replaced with bcrypt/password_hash), confirming their role in the vulnerability. The commit diff shows direct MD5 usage in these functions' pre-patch versions.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| notrinos/notrinos-erp | composer | < 0.7 | 0.7 |
Ongoing coverage of React2Shell