| Package | Affected versions | Patched versions |
|---|---|---|
| phpmyfaq/phpmyfaq | < 4.1.4 | 4.1.4 |
| thorsten/phpmyfaq | < 4.1.4 | 4.1.4 |
Attachment passwords are hashed using SHA-1, a cryptographically broken algorithm. SHA-1 has been vulnerable to collision attacks since 2017 (SHAttered).
Affected File : phpmyfaq/src/phpMyFAQ/Attachment/AbstractAttachment.php
Use bcrypt:
public function setPassword(string $password): void
{
$this->passwordHash = password_hash($password, PASSWORD_BCRYPT);
}
public function verifyPassword(string $plainPassword): bool
{
return password_verify($plainPassword, $this->passwordHash);
}
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free