Magento Stack Exchange is a question and answer site for users of the Magento e-Commerce platform. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was surprised that we can access to admin backend resetting admin user password with md5.

UPDATE `admin_user` SET `password` = MD5('anyword') WHERE `admin_user`.`user_id`= 1;

This is some kind of Magento feature or vulnerability? Why password is not depend on encryption key in local.xml?

share|improve this question
It was a feature but is a vulnerability, because md5 is not broken, but weak. I implemented a extension which replaces the md5 hashing with PBKDF2 for admin users, customer and api passwords: The description says don't use it in production but we and a few others use it without problems. – Fabian Blechschmidt Aug 22 '14 at 12:07
Being able to reset a password this way is not considered a vulnerability. But using an unsalted hash is considered a vulnerability. If support for unsalted hashes only exists for backward compatibility, that is not a problem. But if it uses unsalted hashes by default for new passwords, then that is a vulnerability. – kasperd Aug 22 '14 at 12:21
@FabianBlechschmidt MD5 is broken, but not in a way that directly affects its use in password hashing. Using MD5 is only a minor problem compared to the lack of salt. Salted MD5 would be much stronger than unsalted SHA512. If PBKDF2 is used correctly, it solves both problems, but PBKDF2 could also be used incorrectly. – kasperd Aug 22 '14 at 12:44
Ah yea, you are right about the backwards compatibility. But nonetheless is md5 with salt compared to any new tecnique like pbkdf2, scrypt or bcrypt hacked very fast. And if you know how to use PBKDF2 I would be proud if you review the code ;) – Fabian Blechschmidt Aug 22 '14 at 13:18

The encryption key is used for encryption and decryption, not for hashing.
The user and admin passwords are just hashed.
See how Mage_Admin_Model_User::_beforeSave works.

$data['password'] = $this->_getEncodedPassword($this->getNewPassword());

if you dig deeper into _getEncodedPassword you will find this:

protected function _getEncodedPassword($password)
    return Mage::helper('core')->getHash($password, 2);

Going deeper and deeper you end up on this method for CE:

public function hash($data)
    return md5($data);

and on this for EE.

public function hash($data, $version = self::HASH_VERSION_LATEST)
    if (self::HASH_VERSION_MD5 === $version) {
        return md5($data);
    return hash('sha256', $data);

As for the reason "why" is done this way...I guess it just how it is.
The only reason I can think of is portability. You can transfer customers and admins from one instance to an other and the passwords will still work.

share|improve this answer
But this means any bad man can access user and admin profiles if he has access to database even not using files. – mageUz Aug 22 '14 at 7:57
If he can access the admin profiles with only db access he can access everything else. He can even download a copy of your db and use it on his own magento instance. So you got a bigger problem than that if someone has access to your db. – Marius Aug 22 '14 at 7:59
Debatable point, with passwords stored in plain md5 someone having access to your db gets access to your password which he can further use on the other places. – Cthulhu Aug 22 '14 at 13:55
@Cthulhu. You have a point, but if you use the same password for your admin shop and your gmail see where I'm going with this. – Marius Aug 22 '14 at 13:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.