search

sproctor / php-calendar

PHP-Calendar
http://www.php-calendar.org/
Apache License 2.0
140 stars 67 forks source link

Loose comparison #161

Closed Areizen closed 2 years ago

Areizen commented 5 years ago

The following code snippet in calendar.php could allow an attacker to bypass the login.

if(!$user || $user->password != md5($password))
        return false;

Explanation : If an user password 'md5' starts with 0e an attacker can connect to the website by using any text that md5 starts by 0e since php will compare int instead of the full strings and 0e123... == 0e23... == 0

Areizen commented 5 years ago

You should prefer using this : if(!$user || $user->password !== md5($password))

sproctor commented 2 years ago

Thanks, this change will be included in 2.0.13