cc-wit/attendance — Issue #145: Password recovery does not appear to be secure
Author: Storyyeller
Created: 2012-02-06 18:43:21+00:00
State: open

As far as I can tell, the only information required to change the password on someone's account is the database id of that user, which in turn depends on
1) The time the account was created
2) The virtual machine id of the server at the time the account was created
3) The object counter during that run of the server

For arbitrary accounts, this information would probably take a while to guess. However, if the attacker created an account close to the same time as the target account, then 2 will be the same, and 1 and 3 will be almost the same, making it easy to figure out.