Skip to content

Known Security Issues

Jump to bottom
Nathan Collins edited this page Nov 28, 2018 · 2 revisions

OpenContest has a number of inherent security issues designed to make small contest management much easier. However, these issues make OpenContest unsuitable for larger contests. The following issues are known:

  • HTTP Server. The server does not use SSL.
  • Plain-Text Password Storage. Passwords are stored in plain text in the database and are displayed in plain text to admins.
  • File-Based Database. All of the data behind OpenContest is stored in text files in some folder. If an attacker gained access to this folder, she could control OpenContest.
  • Session Management. OpenContest uses a very simplistic mechanism for session management: a cookie with the user's id. If a user found another user's id, he could log in as the other user.
  • No Ability to Change Password. Users are not able to change their passwords. This feature is in place because the passwords generated by OpenContest are probably more secure than a password that the user would choose. However, if an account is compromised, there is nothing the user can do.

Clone this wiki locally