Executive brief
newbee-mall, an e-commerce platform, uses an obsolete and insecure method for protecting user passwords. Because passwords are stored without modern security safeguards like "salting," an attacker who gains access to the database can easily reverse the protection to reveal the original plaintext passwords. This could lead to widespread account takeovers and the exposure of sensitive customer and administrator credentials.
Technical details
newbee-mall (up to version 1.0.0) utilizes an unsalted MD5 hashing algorithm for password storage and verification within its AdminUserServiceImpl and MD5Util components. The implementation lacks per-user salts and computational cost controls (key stretching), which are standard requirements for modern cryptographic password storage. If an attacker obtains the password hashes through database exposure, SQL injection, or backup leaks, they can perform high-speed offline brute-force or rainbow table attacks to recover plaintext credentials. Additionally, the software ships with default administrator credentials ('admin' / '123456') seeded in the database schema, further increasing the risk of unauthorized access.
Affected products
- newbee-ltd newbee-mall <= 1.0.0
Timeline
- 2026-02-12: disclosed: Vulnerability reported via GitHub issue and VulnCheck advisory.
- 2026-02-12: advisory: NVD publication date.