GHSA-44w5-q257-8428
Exposure of password hashes in notrinos/notrinos-erp
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | notrinos/notrinos-erp | < 0.7 | 0.7 |
Details
As written in the advisory (Markdown source, shown as plain text).
The AP officers account is authorized to Backup and Restore the Database, Due to this he/she can download the backup and see the password hash of the System Administrator account, The weak hash (MD5) of the password can be easily cracked and get the admin password.
References
External links from the advisory. They lead to third-party sites.