Vaelsys V4 Unauthorized Access Vulnerability Leading to MD4 Hash Weakness

A vulnerability in Vaelsys version 4.1.0 has been identified, allowing unauthorized access to the vgrid_server.php file. This issue arises from the MD4 Hash Handler component, where the xajaxargs argument can be manipulated to produce weak hash values. The vulnerability can be exploited remotely, although the attack's complexity is considered high.

Impact

Exploitation of this vulnerability allows for unauthorized access to sensitive information, specifically MD4 password hashes of all system users, which can be easily cracked due to the weakness of the MD4 hashing algorithm.

Reproduction

To reproduce this vulnerability, send a request to the vgrid_server.php file with the xajaxargs parameter. This will initiate a process that retrieves the MD4-encrypted hash values of all users' passwords, starting with the first user, typically the admin.