Newbee Mall Default Admin Credentials Allow Unauthenticated Access

A vulnerability exists in Newbee Mall versions through 1.0.0, where pre-seeded administrator accounts are included in the database initialization script. These accounts come with a predictable default password. If the database is initialized or reset using the provided schema without changing the default credentials, unauthenticated attackers may log in as administrators and gain full control of the application. Additionally, the application uses unsalted MD5 hashing for passwords, allowing for easy cracking of the default passwords.

Impact

Exploitation of this vulnerability could lead to unauthorized administrative access, allowing attackers to take full control of the application.