Description

$response is a salted md5 hash generated based on the concatenated hashed of credentials with other parameters.

It has been discovered that $response compares with $data['response'] using comparison operator != in file login.inc.php. This might cause unexpected behavior due to type juggling.

It is possible to reduce the strength of the hash by using magic hash attack, and leveraged to bypass authentication.

Impact

This vulnerability is capable of authentication bypass

Remidation

Use !== instead