RiteCMS Password Hashing Vulnerability in User Authentication

A vulnerability exists in RiteCMS version 3.1.0 due to the use of weak encryption methods for password storage. This flaw allows an attacker with read access to the database (userdata.db) to recover user passwords offline using readily available hardware. The vulnerability is rooted in the password hashing function, which employs a salted SHA-1 hash—a method considered insecure by modern standards.

Impact

Exploitation of this vulnerability allows for the recovery of user passwords from the database, potentially leading to unauthorized access to user accounts.