The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictionary attacks to crack the hashed passwords.


####  On what page in the application did you find this issue?
https://github.com/ChurchCRM/CRM/blob/74042003a7cdad673bf56c7b6b43a0dabb3ac367/src/ChurchCRM/model/ChurchCRM/User.php#L109
#### On what type of server is this running? Dedicated / Shared hosting?  Linux / Windows?
Windows/xampp
#### What browser (and version) are you running?
Firefox
#### What version of PHP is the server running?
7.4.27
#### What version of SQL Server are you running?
7.4.27
#### What version of ChurchCRM are you running?
4.5.3

**Weak Salt Implementation**

The following report outlines a vulnerability found in the password storage system. The vulnerability arises from the use of a weak salt in the hashing algorithm, which could allow attackers to crack passwords more easily.


[Vulnerable Code: ](https://github.com/ChurchCRM/CRM/blob/74042003a7cdad673bf56c7b6b43a0dabb3ac367/src/ChurchCRM/model/ChurchCRM/User.php#L109)

`hash('sha256', $password . $this->getPersonId());`

Vulnerability Explanation:
The salt used in the hashing algorithm is generated by the $this->getPersonId() method. However, the method returns an integer value, which is not random or unique for each password. This makes the salt predictable and weak, and could allow attackers to use precomputed hash tables or dictionary attacks to crack the hashed passwords.

Impact:
The vulnerability could allow an attacker to crack passwords more easily, which could result in unauthorized access to user accounts and sensitive information.

Recommendation:
To address this vulnerability, it is recommended to use a more secure and unpredictable salt for each password, such as a random value generated for each password. This will make it more difficult for attackers to crack hashed passwords using precomputed hash tables or dictionary attacks.

![WhatsApp Image 2023-02-12 at 8 07 43 PM](https://user-images.githubusercontent.com/50732492/218317623-20f9d95f-7ee1-4471-8670-867f8298937c.jpeg)
![WhatsApp Image 2023-02-12 at 8 07 53 PM](https://user-images.githubusercontent.com/50732492/218317635-248e61a2-0a54-41b9-a477-7363cc9e5b82.jpeg)


Weak Salt Implementation
This is a GitHub Issue
repo:CRM
owner:ChurchCRM
Title : Weak Salt Implementation
Issue date:

--- start body ---


####  On what page in the application did you find this issue?
https://github.com/ChurchCRM/CRM/blob/74042003a7cdad673bf56c7b6b43a0dabb3ac367/src/ChurchCRM/model/ChurchCRM/User.php#L109
#### On what type of server is this running? Dedicated / Shared hosting?  Linux / Windows?
Windows/xampp
#### What browser (and version) are you running?
Firefox
#### What version of PHP is the server running?
7.4.27
#### What version of SQL Server are you running?
7.4.27
#### What version of ChurchCRM are you running?
4.5.3

**Weak Salt Implementation**

The following report outlines a vulnerability found in the password storage system. The vulnerability arises from the use of a weak salt in the hashing algorithm, which could allow attackers to crack passwords more easily.


[Vulnerable Code: ](https://github.com/ChurchCRM/CRM/blob/74042003a7cdad673bf56c7b6b43a0dabb3ac367/src/ChurchCRM/model/ChurchCRM/User.php#L109)

`hash('sha256', $password . $this->getPersonId());`

Vulnerability Explanation:
The salt used in the hashing algorithm is generated by the $this->getPersonId() method. However, the method returns an integer value, which is not random or unique for each password. This makes the salt predictable and weak, and could allow attackers to use precomputed hash tables or dictionary attacks to crack the hashed passwords.

Impact:
The vulnerability could allow an attacker to crack passwords more easily, which could result in unauthorized access to user accounts and sensitive information.

Recommendation:
To address this vulnerability, it is recommended to use a more secure and unpredictable salt for each password, such as a random value generated for each password. This will make it more difficult for attackers to crack hashed passwords using precomputed hash tables or dictionary attacks.

![WhatsApp Image 2023-02-12 at 8 07 43 PM](https://user-images.githubusercontent.com/50732492/218317623-20f9d95f-7ee1-4471-8670-867f8298937c.jpeg)
![WhatsApp Image 2023-02-12 at 8 07 53 PM](https://user-images.githubusercontent.com/50732492/218317635-248e61a2-0a54-41b9-a477-7363cc9e5b82.jpeg)


--- end body ---
