CVE-2023-36140

In PHPJabbers Cleaning Business Software 1.0, there is no encryption on user passwords allowing an attacker to gain access to all user accounts

published September 11, 2023

CVSS
—
EPSS
1%
Percentile
43.9
In the wild
Unconfirmed
What it is

⚠️ User passwords are out in the open! In PHPJabbers Cleaning Business Software 1.0, there's no encryption on user passwords, making a hacker's job mind-blowingly simple. 😱 Think of it like a hotel safe with the combination written on a sticky note right on the front. Anyone can just walk up and access your valuables without any effort! If an attacker gets hold of these passwords, they could waltz right into any user account, exposing sensitive information and wreaking havoc. It's like leaving your front door wide open and inviting in every burglar in town!

Put simply

Think of it like a hotel safe with the combination written on a sticky note right on the front. Anyone can just walk up and access your valuables without any effort! This vulnerability allows attackers to access user accounts because user passwords are stored in plaintext, meaning no encryption is applied to protect them. Consequently, anyone with access to the database can easily read these passwords and compromise user accounts.

What to do

If an attacker gets hold of these passwords, they could waltz right into any user account, exposing sensitive information and wreaking havoc. It's like leaving your front door wide open and inviting in every burglar in town! To protect your users, it’s crucial to upgrade PHPJabbers Cleaning Business Software to a version that implements proper password hashing and encryption. Additionally, audit your existing user accounts and encourage users to change their passwords post-update. 🛡️ You've got this! By taking these steps, you'll be elevating your security game and protecting your users! 🚀

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00530 · 43.9th percentile
Published
2023-09-11T00:00Z
EPSS history
Timeline
  • 11 SEP 00:00Z
    In PHPJabbers Cleaning Business Software 1.0, there is no encryption on user passwords allowing an attacker to gain access to all user accounts
    cvelistv5