Weak Password Recovery in iWebShop-5

Executive Summary

This vulnerability is a weak password recovery issue in iWebShop-5 up to version 5.16. It involves the function send_message_mobile in controllers/simple.php where manipulating the user_id argument leads to predictable five-digit password reset codes. These codes are easily brute-forced due to lack of rate-limiting and long validity periods.

Useful 0 Not Useful 0

Detection Guidance

Check if your iWebShop-5 instance uses the vulnerable functions in controllers/simple.php, particularly send_message_mobile, find_password_mobile, restore_password, or do_restore_password. Inspect the password reset code generation logic for hardcoded rand(10000, 99999) calls. Monitor network traffic for repeated requests to password reset endpoints without rate limiting.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this to reset any user's password by guessing the five-digit code. If they know a user's ID, they can systematically try all 90,000 possible combinations within 72 hours to gain full account access. This results in complete account takeover and potential data theft or unauthorized actions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR's requirement for strong authentication and data protection (Article 32) and HIPAA's security rule for safeguarding electronic protected health information. It enables unauthorized access to sensitive user data, potentially leading to compliance breaches and legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Disable mobile password reset functionality if not critical. Implement rate limiting on password reset endpoints. Replace the weak five-digit reset codes with cryptographically secure tokens (128+ bits). Store only hashed tokens and reduce validity to minutes. Enforce single-use tokens and strict rate limiting per account or IP address.

Useful 0 Not Useful 0