ACA System ClearText Password Storage & Dashboard Disclosure Vulnerability Analysis

Vulnerability Overview Title: Plaintext password storage and dashboard disclosure Vulnerability Type: Cleartext Storage of Sensitive Information Root Cause: The application stores passwords as ordinary recoverable data in the database without using one-way hash functions such as / ; the login logic directly compares the stored value with the submitted value, and the dashboard HTML echoes the password through the unescaped , making the password directly readable. Impact: Any database leakage, dashboard access, or IDOR vulnerability could expose the reusable account passwords; an attacker can use the recovered password to log into the system, which is especially impactful when passwords are reused across systems. Scope of Impact Affected Versions: Commit Affected Files: - - , , - , , Key Code (POC / Exploit Code) aca.zip/aca.sql admin_login.php / student_login.php / teacher_login.php admin_dashboard.php / student_dashboard.php / teacher_dashboard.php Reproduction Steps (POC) 1. Inspect the SQL seed data: Sample output: 2. Query the student dashboard record and check the HTML response: The following was observed in the response: Remediation 1. Hash the passwords: Use to store passwords and to validate them during login, eliminating plaintext storage. 2. Remove dashboard echo: Remove or escape the in the dashboard to prevent the password value from being rendered directly in the HTML. 3. Access control: Add authentication and parameter validation to the dashboard endpoints to prevent IDOR-based password disclosure. 4. Data migration: Perform a batch hash migration for existing plaintext passwords and force users to reset their passwords.

Goal Reached Thanks to every supporter — we hit 100%!

ACA System ClearText Password Storage & Dashboard Disclosure Vulnerability Analysis

More from this source