elunez eladmin Hardcoded DES Key Vulnerability in EncryptUtils Class

A vulnerability exists in the elunez eladmin application in versions through 2.7. The issue arises in the EncryptUtils class, specifically within the DES Key Handler component. The vulnerability is due to hardcoded encryption keys and initialization vectors, which create fixed and predictable cryptographic parameters. This flaw allows for inadequate encryption strength, as demonstrated by the manipulation of the STR_PARAM argument with the input 'Passw0rd'. The vulnerability can be exploited remotely, but the exploitation is considered difficult.

Impact

The hardcoded DES key vulnerability allows for unauthorized decryption of data, forgery of encrypted messages to bypass security controls, and potential privilege escalation and data leakage.