CVE-2026-25861 — AI Deep Analysis Summary

🚨 **Root Cause**: Weak password hashing algorithm (MD5) + auto-generated passwords too short (8 characters).<br>💥 **Impact**: Attackers can easily perform **offline brute-force attacks** to directly **recover user passwo…

🔍 **CWE**: Weak hashing algorithm (MD5).<br>📍 **Defect Point**: The `Tools::encrypt()` function in `classes/Tools.php`.…

📦 **Affected Versions**: QloApps version **1.7.0 and below**.<br>🧩 **Key Components**: `classes/Tools.php` (encryption logic) and `classes/Customer.php` (account conversion logic).

🕵️ **Attacker Capabilities**: Can be exploited without authentication.<br>🔓 **Privileges/Data**: By offline cracking the MD5 hash, attackers can **obtain plaintext passwords**, thereby **fully controlling user accounts**…

📉 **Low Barrier to Entry**.<br>🔑 **Authentication**: Not required (PR:N).<br>⚙️ **Configuration**: Exploits default weak hashing and short password generation logic; attackers only need to obtain the hash value to perfor…

📄 **PoC/Exp**: The `pocs` field in the provided data is empty; no public ready-made exploit is currently available.<br>🌍 **In-the-Wild Exploitation**: Not mentioned.…

🔎 **Self-Check Method**:<br>1. Check if the QloApps version is ≤ 1.7.0.<br>2. Review whether `Tools::encrypt()` in `classes/Tools.php` still uses MD5.<br>3.…

🛡️ **Officially Fixed**.<br>📌 **Patch**: Commit `64e9722` has fixed this vulnerability.<br>✅ **Recommendation**: Immediately upgrade to the latest patched version.

⚠️ **Temporary Mitigation** (if no patch is available):<br>1. **Enforce Strong Password Policy**: Ensure all user passwords are longer than 8 characters and have high complexity.<br>2.…

🔥 **Priority: High**.<br>📅 **CVSS**: 3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.<br>💡 **Reasoning**: Although the Attack Complexity (AC:H) is slightly higher due to MD5 characteristics, the **Confidentiality Impact (C:H) is…