WS-2023-0072

Date: January 24, 2023

In FusionCMS (FusionGen), it was discovered that the password recovery feature on the website is vulnerable to predictable key and password generation. An attacker is able to predict the key used in the password recovery process and the generated password itself by using a specific PHP command and the user's email and username. An attacker can gain access to a user's account by predicting the key and generated password. This can potentially lead to sensitive information being compromised. The key generation process should be made more secure by using a cryptographically secure algorithm and adding a unique and unpredictable salt. The password generation process should also be made more secure by using a cryptographically secure random number generator.

Language: PHP