CVE-2023-40173 Unsalted passwords in fobybus/social-media-skeleton
Attackers can crack user passwords if they access the database because the application stores unsalted password hashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-40173?
CVE-2023-40173 is a high-severity vulnerability in fobybus social-media-skeleton, published on 18 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Prior to version 1.0.5 Social media skeleton did not properly salt passwords leaving user passwords susceptible to cracking should an attacker gain access to hashed passwords. This issue has been addressed in version 1.0.5 and users are advised to upgrade. There are no known workarounds for this issue.
Weakness: CWE-522
Which versions are affected by CVE-2023-40173?
It affects 1 product.
Products include Fobybus Social-Media-Skeleton.
How do I fix CVE-2023-40173?
No fix has been published for CVE-2023-40173 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-40173 being exploited?
There is no known exploitation of CVE-2023-40173 in the wild and no public exploit code.
Other vulnerabilities in fobybus social-media-skeleton
- CVE-2023-39344 social-media-skeleton vulnerable to Pre-Auth SQLi leading to RCE
- CVE-2023-40174 Insufficient Session Expiration in fobybus/social-media-skeleton
- CVE-2023-40172 Cross-Site Request Forgery (CSRF) in fobybus/social-media-skeleton
- CVE-2023-39518 social-media-skeleton stored Cross-site Scripting vulnerability
Sources
Also known as GHSA-rfmv-7m7g-v628.