GUnet OpenEclass Plaintext Password Storage Vulnerability

A vulnerability exists in GUnet OpenEclass version 1.7.3, where user credentials are stored in plaintext. This allows administrators to access all registered users' usernames and passwords without any encryption. The vulnerability increases the risk of credential theft and unauthorized access.

Impact

Exploitation of this vulnerability leads to unauthorized access to user accounts, with the potential for further exploitation of authenticated user privileges.

Reproduction

To reproduce this vulnerability, log into the GUnet OpenEclass platform as an administrator. Navigate to the 'listusers.php' admin module, where all registered users' credentials can be viewed in plaintext. Alternatively, this vulnerability can be exploited through an unauthenticated blind SQL injection, which extracts administrator credentials from the database. After obtaining admin rights, the same plaintext password storage vulnerability can be accessed.