Threats tagged 'ghsa-p33h-chx9-f9hf'

SQLBot versions through 1.10.3 use unsalted MD5 hashing for storing local account passwords in the sys_user.password field. This weak hashing method allows attackers who access the user table to recover passwords, including administrator credentials, via precomputed hash tables or GPU-accelerated cracking. The vulnerability arises from the use of md5pwd() in security.py, which does not apply salting to the hashes.