CVE-2018-15680
📋 TL;DR
XBTIT 2.5.4 stores user passwords as unsalted MD5 hashes, making them vulnerable to brute-force attacks. Attackers can crack these weak hashes to obtain plaintext passwords, compromising user accounts. All XBTIT 2.5.4 installations using default configuration are affected.
💻 Affected Systems
- BTITeam XBTIT
📦 What is this software?
Xbtit by Btiteam
⚠️ Risk & Real-World Impact
Worst Case
Mass account compromise leading to complete system takeover, data theft, and lateral movement within the network.
Likely Case
Targeted account takeover of specific users, credential stuffing attacks, and unauthorized access to sensitive torrent tracker data.
If Mitigated
Limited impact if strong password policies and additional authentication controls are in place.
🎯 Exploit Status
Exploitation requires database access (e.g., via SQL injection or stolen database dump). Attackers can then use rainbow tables or GPU cracking tools on the unsalted MD5 hashes.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch exists. Migrate to a secure password hashing algorithm like bcrypt or Argon2, and force password resets for all users.
🔧 Temporary Workarounds
Implement Strong Password Hashing
allReplace MD5 with a modern, salted hashing algorithm (e.g., bcrypt, Argon2) in the authentication code.
Modify PHP authentication logic to use password_hash() and password_verify() functions with PASSWORD_BCRYPT.
Enforce Password Reset
allForce all users to change passwords after implementing strong hashing.
Set password reset flag in user database and notify users via email.
🧯 If You Can't Patch
- Implement multi-factor authentication (MFA) to add an extra layer of security.
- Enforce strong password policies (minimum 12 characters, complexity requirements) and monitor for brute-force attempts.
🔍 How to Verify
Check if Vulnerable:
Check the xbtit_users table in the database: if password column contains 32-character hexadecimal strings (unsalted MD5), the system is vulnerable.Check Version:
Check the version in the XBTIT admin panel or review the source code for version identifiers.Verify Fix Applied:
Verify that new passwords are stored as longer, salted hashes (e.g., bcrypt produces 60-character strings) and that password_verify() works correctly.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts for different accounts, unusual login times or locations.
Network Indicators:
- Unusual database query patterns or SQL injection attempts targeting the users table.
SIEM Query:
source="web_logs" AND (event="login_failed" AND count > 10) OR (event="sql_injection" AND table="xbtit_users")