4 ms·
No you can't (or rather, it's not very useful). Sure, you can set someone's password to something you know that way - but since you've already got write access
by jbri 15y ago
No you can't (or rather, it's not very useful). Sure, you can set someone's password to something you know that way - but since you've already got write access to the database, you might as well do it directly.
This is a flaw of any system that sends your password back to you in plain text, that is not shared by systems that don't.
- ceejayoz 15y agoIf I can change your e-mail in the database and have it send me your password reset e-mail, I'm in. Write access to the database is a huge issue in that case whether or not passwords are hashed, encrypted, or plain text.