Jivejdon CVE-2026-107829

Exploitation is NOT self-contained: the attacker must first obtain the account table, either through a separate SQL injection vulnerability or direct read access to the backend database that stores Jivejdon user credentials. The specific enabling defect is that passwords are stored as unsalted MD5 digests (ToolsUtil.hash() called from AccountDaoSql), so any disclosed hash is crackable offline with precomputed tables or GPU attacks - there is no per-user salt or key-stretching to slow recovery. The primary LIMITING factor is this prerequisite database/table access (captured by AC:H and AT:P in the CVSS 4.0 vector); the weakness cannot be triggered remotely against a default deployment without that prior compromise, which is why it functions as an impact amplifier rather than an initial-access vector.

This is a weak password storage flaw (CWE-916: unsalted MD5 via ToolsUtil.hash) rather than a direct access vulnerability, which strongly shapes its real-world risk. The vendor-assigned CVSS 4.0 score of 8.2 is elevated primarily by VC:H (full credential disclosure once hashes are cracked), but it is tempered by AC:H and AT:P, correctly reflecting that exploitation is not self-contained: an attacker must FIRST obtain the user table via separate database access or SQL injection. No EPSS score, CISA KEV listing, or POC was provided in the intelligence, so there is no signal of active or probable exploitation - consistent with a defense-in-depth/credential-amplification weakness rather than an internet-facing RCE. Note a nuance: the vector lists PR:N (unauthenticated), yet the description's precondition ('obtain the user table through database access or SQL injection') implies meaningful prior access is required - the PR:N reflects that the hashing weakness itself needs no authentication, not that the overall attack is trivial. Net assessment: a legitimate hardening priority that materially worsens the impact of any database breach, but not a standalone high-urgency flaw absent evidence of exploitation.

An attacker leverages a separate SQL injection flaw or gains read access to the Jivejdon backend database and exfiltrates the account table containing unsalted MD5 password digests. Because the hashes lack salting, the attacker recovers plaintext passwords offline using precomputed rainbow tables or GPU-accelerated brute force, then reuses the credentials to log in as legitimate users or administrators. No public exploit code was identified, and the attack depends on first achieving the database-access precondition (reflected by AC:H/AT:P).