I'm not interesting in further dehumanizing myself with participation in a bug bounty program. I'll write an exploit for it (the general case, not just Piwik i

I'm not interesting in further dehumanizing myself with participation in a bug bounty program. I'll write an exploit for it (the general case, not just Piwik in particular) and drop it on OSS Sec some day, but here's a theoretical attack: 1. Guess a username somehow. Maybe "admin"? Whatever, we're interested in the security of the hash function. Let's assume we have the username for our target. 2. Calculate a bunch of guess passwords, such that we have one hash output for each possible value for the first N hexits. e.g. substr(md5($string), 0, 2) === "00" substr(md5($string), 0, 2) === "01" substr(md5($string), 0, 2) === "02" // ... substr(md5($string), 0, 2) === "ff" 3. Send these guess passwords repeatedly and use timing information to get an educated guess on the first valid MD5 hash. 4. Iterate steps 2 and 3 until you have the first N bytes of the MD5 hash for the password. 5. Use offline methods to generate password guesses against a partial hash. The end result: A timing attack that consequently allows an optimized offline guess. So even if their entire codebase is immune to SQL injection, you can still launch a semi-blind cracking attempt against them.