webcalendar
webcalendar copied to clipboard
Using encryption instead of md5 hashes
I noticed, that this application is using the md5 hash function for password 'encryption'. This applies to the initial browser password (stored in webcalendar/includes/settings.php), and to the user passwords, stored in the webcal_user table of the database as well.
Md5 hashes are proven to be insecure, because they are vulnerable to collision attacks and can be cracked using rainbow tables (or by just simply googling a hash). It would be better to use the CRYPT mysql function or sha512 instead.