renlok / WeBid

The official WeBid github fork
http://www.webidsupport.com
114 stars 125 forks source link

Funcational bugs in password rechecking during registration related processes #530

Open peng-hui opened 4 years ago

peng-hui commented 4 years ago

WeBid 1.2.2 has the problem of password rechecking during registration because it uses a loose comparison to check the identicalness of two passwords. Two non-identical passwords can still bypass the check. $password1 = "0e1111" and $password2 = "0e2222" are loosely compared and return bool(true). A lot of other PHP scripts in WeBid also have this problem.