My company purchased this system for developing portals. Recently, due to a copy and paste error, I stumbled across this bug in the login mechanism of the administration module.
If your password is "mypassword", as long as you enter "mypassword" at the beginning, it doesn't matter if there's rubbish characters behind it.
"mypassword" will be accepted.
"mypasswordHAHA" will be accepted.
"HAHAmypassword" will be rejected.
WOW.
No comments:
Post a Comment