CVE-2006-4068
The pswd.js script relies on the client to calculate whether a username and password match hard-coded hashed values for a server, and uses a hashing scheme tha…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PSWD.JS - Insecure Password Hash2006-08-03 · webapps · multiple · Verified
Impact
The pswd.js script relies on the client to calculate whether a username and password match hard-coded hashed values for a server, and uses a hashing scheme that creates a large number of collisions, which makes it easier for remote attackers to conduct offline brute force attacks. NOTE: this script might also allow attackers to generate the server-side "secret" URL without determining the original password, but this possibility was not discussed by the original researcher.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pswd.Js | Pswd.Js | All versions |