Description

The AP officers account is authorized to Backup and Restore the Database, Due to this he/she can download the backup and see the password hash of the System Administrator account, The weak hash (MD5) of the password can be easily cracked and get the admin password.

Proof of Concept

Steps to reproduce

1- Login as  AP officers account.
2- Click on Create Backup.
3- After the Backup is created click on View Backup, this will open a new tab showing the backup file.

4-  Scroll down to `Data of table 0_users`, and you see the MD5 hash of the admin user.

5- Crack the MD5 hash using hashcat or any tool.