An information disclosure vulnerability in jshERP versions 3.6 and earlier allows authenticated attackers to retrieve unsalted password hashes, posing a significant risk of account compromise.

The application suffers from an improper sensitive data exposure (CWE-200) within the /user/info endpoint. Any authenticated user can supply a target user ID to retrieve that user's unsalted MD5 password digest, which can then be cracked offline or used for credential stuffing.

Successful exploitation allows unauthorized access to sensitive user credentials, including those of administrative accounts. This exposure significantly increases the risk of account takeover, potential data breaches, and unauthorized system access. While the CVSS score of 6.5 reflects a Medium severity, the ability to obtain password hashes for any user in the system presents a severe threat to the overall security posture of the application.

Immediate Action: Upgrade to the latest version of jshERP provided by the vendor, which includes the necessary fix to properly sanitize user information responses.

Proactive Monitoring: Review web server and application logs for anomalous patterns of repeated requests to the /user/info endpoint, particularly those originating from low-privilege accounts targeting multiple user IDs.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules to inspect and block responses from the /user/info endpoint if they contain password-related fields or MD5 hash patterns.

Public Exploit Available: Yes, a proof-of-concept script is available via the researcher's GitHub repository.

The exposure of unsalted MD5 password digests is a critical security failure that renders password protection ineffective against offline cracking. Administrators must treat this vulnerability with high urgency and prioritize applying the vendor-provided patch to prevent the mass harvesting of user credentials within the environment.