Executive brief
Pik Online Portal, a web-based business management system, uses password hashing without salt—a weak cryptographic practice that allows attackers to perform brute-force and rainbow table attacks to crack user passwords. Successful exploitation could lead to unauthorized account access and compromise of sensitive business data.
Technical details
The vulnerability stems from the use of unsalted one-way hashing functions for password storage. This cryptographic weakness enables attackers to precompute hash tables (rainbow tables) and conduct efficient brute-force attacks against captured password hashes, bypassing the security benefits of hashing. The flaw is present in Pik Online Portal versions through 3.5.1. Although the attack requires the attacker to obtain password hashes (typically via database breach or network interception), the lack of salt significantly reduces the computational effort required to recover plaintext passwords, allowing for offline cryptanalysis.
Affected products
- Pik Online Software Solutions Inc. Pik Online Portal through 3.5.1
Timeline
- 2026-09-04: disclosed