RiteCMS CVE-2025-67168

Exploitation is NOT standalone-remote despite the AV:N rating: the attacker must first obtain the stored password values for RiteCMS v3.1.0 - typically requiring prior access to the application's backend database, a readable configuration/backup, or filesystem access to the server. Only then does the insecure encryption/weak hashing (CWE-916) in RiteCMS v3.1.0 allow recovery of plaintext credentials. Limiting factors: no evidence of a default-configuration network path to the password store, no active exploitation (not in KEV), low EPSS (0.14%), and impact is confined to confidentiality of stored credentials (I/A unaffected). The vulnerability amplifies the consequences of a separate data-exposure flaw rather than being independently triggerable.

This is a HIGH-CVSS-label-but-modest-real-risk issue once signals are cross-referenced. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:L) rates it 5.3 Medium and implies a remote, unauthenticated path to limited confidentiality loss. That framing is questionable for a CWE-916 weakness: insecure password storage is not directly reachable over the network - an attacker must FIRST obtain the stored password material (via a separate database-access vector, backup exposure, or server access) before the weak encryption/hashing matters. So the AV:N/PR:N metrics overstate direct exploitability - verify with vendor/analyst. The exploitation probability is low (EPSS 0.14%, 3rd percentile) and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation. A public PoC exists (mbiesiad vulnerability-research repo), but PoC availability is a distinct signal from in-the-wild use and does not elevate this to active-exploitation status. Net: a legitimate credential-storage hardening defect that amplifies the impact of a breach, but a low operational priority absent another vulnerability that exposes the stored hashes.

An attacker who already has access to the RiteCMS backend data store - through a separate SQL injection, an exposed database/backup, or server compromise - retrieves the stored user passwords and, because RiteCMS v3.1.0 protects them with insecure encryption/weak hashing (CWE-916), recovers the plaintext credentials with minimal effort. A public proof-of-concept documents the weak algorithm, lowering the skill needed to reproduce the credential recovery.