The vulnerability in cjbi admin3 (up to version 3.0.0) involves the use of single-round MD5 hashing for storing account passwords, salted only by the username and lacking any key derivation function. This approach provides insufficient computational effort to resist offline attacks, enabling attackers who gain database access to efficiently recover plaintext passwords through dictionary or brute-force methods.

Attackers with access to the password database can recover plaintext passwords with relatively low computational effort, potentially leading to account compromise. The confidentiality of user credentials is at risk, but there is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to avoid using affected versions or implement additional protective measures such as enforcing strong password policies and monitoring for unauthorized database access.