CVE-2023-40173 (SQL, published 2023-08-18T22:15Z)
Description: value: Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Prior to version 1.0.5 Social media skeleton did not properly salt passwords leaving user passwords susceptible to cracking should an attacker gain access to hashed passwords. This issue has been addressed in version 1.0.5 and users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-522 \u2014 Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Repository: https://github.com/fobybus/social-media-skeleton
Files changed:
sql/pipago_db.sql
Commit message: added salting tables and modified password for default users


Vulnerable code:
(1000, 'admin1@pipago.com', 'admin1login');
(1001, 'firaol', 'wakuma', '2022-04-21', 'addis abeba ', 'firaol@email.com', 'password123', 'male', 'is', '2022-04-25 14:47:39', '2022-04-25 14:47:39', '');

Fixed code:
-- use password123 for both normal and admin user 
-- Generation Time: Aug 15, 2023 at 03:01 PM
(1000, 'admin@pipago.com', '86dd76e74017a9a4856c5c6d6937e471fa6f80f41b720428c0a73610d7dbbe75');

-- --------------------------------------------------------

--
-- Table structure for table `adminsalt`
--

CREATE TABLE `adminsalt` (
  `sid` int(11) NOT NULL COMMENT 'salt id',
  `aid` int(11) NOT NULL COMMENT 'admin id',
  `salt` varchar(32) NOT NULL COMMENT 'salt'
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

--
-- Dumping data for table `adminsalt`
--

INSERT INTO `adminsalt` (`sid`, `aid`, `salt`) VALUES
(1, 1000, '65c53cd5c62fec1766ad6bef6aac1253');
(1001, 'firaol', 'wakuma', '2022-04-21', 'addis abeba ', 'firaol@email.com', '49620aa0869973f5584dbdefc5c50b23646cab16e3f16a5cbe27cfd1a81d55d7', 'male', 'is', '2023-08-15 11:40:15', '2022-04-25 14:47:39', '');

-- --------------------------------------------------------

--
-- Table structure for table `usersalt`
--

CREATE TABLE `usersalt` (
  `sid` int(11) NOT NULL COMMENT 'salt id',
  `uid` int(11) NOT NULL COMMENT 'user id',
  `salt` varchar(32) NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

--
-- Dumping data for table `usersalt`
--

INSERT INTO `usersalt` (`sid`, `uid`, `salt`) VALUES
(1, 1001, '00e7a17d32f03da112294fbed42f3c4c');
--
-- Indexes for table `adminsalt`
--
ALTER TABLE `adminsalt`
  ADD PRIMARY KEY (`sid`),
  ADD KEY `aid` (`aid`);

--
-- Indexes for table `usersalt`
--
ALTER TABLE `usersalt`
  ADD PRIMARY KEY (`sid`),
  ADD KEY `uid` (`uid`);

--
-- AUTO_INCREMENT for table `adminsalt`
--
ALTER TABLE `adminsalt`
  MODIFY `sid` int(11) NOT NULL AUTO_INCREMENT COMMENT 'salt id', AUTO_INCREMENT=2;

--
-- AUTO_INCREMENT for table `usersalt`
--
ALTER TABLE `usersalt`
  MODIFY `sid` int(11) NOT NULL AUTO_INCREMENT COMMENT 'salt id', AUTO_INCREMENT=2;

--
-- Constraints for table `adminsalt`
--
ALTER TABLE `adminsalt`
  ADD CONSTRAINT `adminsalt_ibfk_1` FOREIGN KEY (`aid`) REFERENCES `admin` (`admin_id`) ON DELETE CASCADE ON UPDATE CASCADE;


--
-- Constraints for table `usersalt`
--
ALTER TABLE `usersalt`
  ADD CONSTRAINT `usersalt_ibfk_1` FOREIGN KEY (`uid`) REFERENCES `users` (`id`) ON DELETE CASCADE ON UPDATE CASCADE;