Description

Use of incorrect operator == and != for page_psw

Proof of Concept

If my actual page password is 240610708 then an attacker can key in QLTHNDT because:

md5(240610708) = 0e462097431906509019562988736854

md5(QLTHNDT) = 0e405967825401955372549139051580

And PHP will evaluate '0e462097431906509019562988736854' == '0e405967825401955372549139051580' as true. This is because == does not enforce strict type checking. Hence the above will be treated as integers, since 0e... is essentially 0. The above is essentially evaluating if 0==0 which is true

List of possible passwords: https://github.com/spaze/hashes/blob/master/md5.md

Impact

This vulnerability is capable of bypassing the need for correct page passwords if the password starts with 0e...