Exploitation Summary
EIP tracks 1 public exploit for CVE-2021-36460. PoCs published by martinfrancois.
AI-analyzed exploit summary The repository provides a detailed technical analysis of CVE-2021-36460, a vulnerability in the VeryFitPro app where password hashes are used for authentication instead of the actual password. This allows for a Pass the Hash attack, enabling account takeover without knowledge of the original password.
Description
VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user's account, rendering the benefits of storing hashed passwords in the database useless.
Exploits (1)
The repository provides a detailed technical analysis of CVE-2021-36460, a vulnerability in the VeryFitPro app where password hashes are used for authentication instead of the actual password. This allows for a Pass the Hash attack, enabling account takeover without knowledge of the original password.
References (3)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H