Fanli2012 Native-PHP-CMS Default Credentials Vulnerability in User Password Recovery Script

A critical vulnerability exists in Fanli2012 native-php-cms version 1.0, specifically within the file '/fladmin/user_recoverpwd.php'. This vulnerability allows for the use of default credentials, enabling remote password resets for the administrator account. The issue arises from a logic flaw that permits the manipulation of password recovery processes, effectively bypassing authentication requirements.

Impact

Exploitation of this vulnerability allows for unauthorized password resets, granting attackers access to the administrator account.

Reproduction

To reproduce this vulnerability, import the default SQL file 'flcms.sql' into a database. After setting up the application, navigate to '/fladmin/user_recoverpwd.php'. The script can be exploited by sending a request that includes the username 'admin888'. The script will respond with a password reset, changing the password to 'admin' and allowing access to the admin account.