Description
SQLBot through 1.10.3 contains a weak password hashing vulnerability that stores local account passwords in sys_user.password as unsalted MD5 digests via md5pwd() in security.py. Attackers who obtain the user table can recover passwords, including administrator passwords, using precomputed tables or GPU cracking, since identical passwords produce identical hashes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dataease | SQLBot | ≤ 1.10.3 | — |
References
- GitHub Issue #1432 issue-tracking
- https://github.com/dataease/SQLBot product
- https://github.com/dataease/SQLBot/commit/8b4097f216d0d57e7c82f12ef6b36add1f64e49e patch
- https://github.com/dataease/SQLBot/pull/1466 issue-tracking patch
- https://github.com/dataease/SQLBot/blob/96f06c7eade60ecf3e6af0313821373761d1fb85/backend/common/core/security.py#L32-L35 technical-description
- VulnCheck Advisory: SQLBot through 1.10.3 Weak Password Hashing via Unsalted MD5 third-party-advisory