Pik Online Portal
Monthly
Pik Online Portal through version 3.5.1 stores hashes without cryptographic salts (CWE-759), exposing stored credentials to offline cryptanalysis via rainbow table or precomputed dictionary attacks. The CVSS vector (PR:L/UI:R) indicates that a low-privileged attacker who can access hash data - and where some user interaction occurs to trigger or expose the hash - can recover plaintext passwords with high confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis; this was reported by TR-CERT (Turkish national cybersecurity authority).
Pik Online Portal through version 3.5.1 stores hashes without cryptographic salts (CWE-759), exposing stored credentials to offline cryptanalysis via rainbow table or precomputed dictionary attacks. The CVSS vector (PR:L/UI:R) indicates that a low-privileged attacker who can access hash data - and where some user interaction occurs to trigger or expose the hash - can recover plaintext passwords with high confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis; this was reported by TR-CERT (Turkish national cybersecurity authority).