BaseFortify

Executive Summary

PHPNuxBill through 2025.3.20 has an account takeover vulnerability in the customer password reset process. The flaw is in system/controllers/forgot.php where unauthenticated attackers can brute-force a 6-digit OTP code. If an attacker knows a customer's username, they can repeatedly guess the OTP without limits or lockouts. Once the correct code is entered, the attacker can set a new password and hijack the account by reading the response.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for repeated failed password reset attempts targeting the customer username field in system/controllers/forgot.php. Check web server logs for excessive POST requests to the forgot password endpoint with the same username and varying 6-digit otp_code values. Look for HTTP responses containing newly set passwords after successful OTP submissions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to take over customer accounts by guessing the password reset code. If you are a user of PHPNuxBill, an attacker knowing your username could reset your password, gain access to your account, and potentially steal sensitive data or perform unauthorized actions. The lack of rate limiting makes this attack feasible and dangerous.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using PHPNuxBill may face compliance violations, legal penalties, and reputational damage if customer data is exposed due to this flaw.

Useful 0 Not Useful 0

Mitigation Strategies

• Implement rate limiting on the password reset endpoint to prevent brute-force attempts.
• Add account lockout after a small number of failed OTP attempts (e.g., 3-5 attempts).
• Replace the 6-digit OTP with a longer, more complex code (e.g., 8+ characters with mixed types).
• Ensure the HTTP response does not expose the newly set password in the body or headers.
• Upgrade PHPNuxBill to the latest patched version if available.

Useful 0 Not Useful 0