CVE-2022-36072 SilverwareGames.io used == for hashing instead of ===
Attackers can bypass authentication on SilverwareGames.io by exploiting PHP loose comparison of hashes starting with 0e, allowing unauthorized account access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-36072?
CVE-2022-36072 is a medium-severity authentication bypass vulnerability in mesosoi silverwaregames-io-issue-tracker, published on 6 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SilverwareGames.io is a social network for users to play video games online. In version 1.1.8 and prior, due to an unobvious feature of PHP, hashes generated by built-in functions and starting with the `0e` symbols were being handled as zero multiplied with the `e` number. Therefore, the hash value was equal to 0. The maintainers fixed this in version 1.1.9 by using `===` instead of `==` in comparisons where it is possible (e.g. on sign in/sign up handlers).
Weakness: CWE-597
Which versions are affected by CVE-2022-36072?
It affects 1 product.
Products include Silverwaregames Silverwaregames.
How do I fix CVE-2022-36072?
No fix has been published for CVE-2022-36072 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-36072 being exploited?
There is no known exploitation of CVE-2022-36072 in the wild and no public exploit code.
Other vulnerabilities in mesosoi silverwaregames-io-issue-tracker
- CVE-2022-23543 HTML attributes when attaching a YouTube link to the post
- CVE-2023-40179 Silverware Games vulnerable to account enumeration via inconsistent responses
- CVE-2023-40182 Information disclosure in silverwaregames-io-issue-tracker
- CVE-2023-29192 Missing authorization in silverwaregames-io-issue-tracker