{"id":"CVE-2026-94413","published":"2026-09-21T19:17:20.377","lastModified":"2026-09-21T19:17:20.377","description":"jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direct authentication bypass.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-200"],"vendors":[],"products":[],"references":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/jshERP/poc-03-user-info-password-hash-disclosure.py","tags":[]},{"url":"https://github.com/jishenghua/jshERP","tags":[]},{"url":"https://github.com/jishenghua/jshERP/blob/v3.6/jshERP-boot/src/main/java/com/jsh/erp/controller/UserController.java#L65-L77","tags":[]},{"url":"https://www.vulncheck.com/advisories/jsherp-through-3.6-password-hash-disclosure-via-user-info","tags":[]}],"exploitRefs":[{"url":"https://github.com/LinYuanyi1/cve-request-poc/blob/master/jshERP/poc-03-user-info-password-hash-disclosure.py","tags":[]},{"url":"https://github.com/jishenghua/jshERP","tags":[]},{"url":"https://github.com/jishenghua/jshERP/blob/v3.6/jshERP-boot/src/main/java/com/jsh/erp/controller/UserController.java#L65-L77","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows authenticated users to retrieve unsalted MD5 password hashes, enabling attackers to perform offline cracking or direct authentication bypass.","exploitability":"Exploitation requires an authenticated user and knowledge of the target's user ID; moderately difficult due to authentication requirement but feasible with minimal effort.","blast_radius":"If exploited, it could lead to unauthorized access and potential compromise of all users' accounts on the system.","remediation":"Update jshERP to the latest version or apply a patch that properly redacts password hashes in responses.","tags":["auth-bypass","password-cracking","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-22T06:20:01.632Z"}}