I&#x27;m not interesting in further dehumanizing myself with participation in a bug bounty program.<p>I&#x27;ll write an exploit for it (the general case, not just Piwik in particular) and drop it on OSS Sec some day, but here&#x27;s a theoretical attack:<p>1. Guess a username somehow. Maybe &quot;admin&quot;? Whatever, we&#x27;re interested in the security of the hash function. Let&#x27;s assume we have the username for our target.<p>2. Calculate a bunch of guess passwords, such that we have one hash output for each possible value for the first N hexits.<p>e.g.<p><pre><code>    substr(md5($string), 0, 2) === &quot;00&quot;
    substr(md5($string), 0, 2) === &quot;01&quot;
    substr(md5($string), 0, 2) === &quot;02&quot;
    &#x2F;&#x2F; ...
    substr(md5($string), 0, 2) === &quot;ff&quot;
</code></pre>
3. Send these guess passwords repeatedly and use timing information to get an educated guess on the first valid MD5 hash.<p>4. Iterate steps 2 and 3 until you have the first N bytes of the MD5 hash for the password.<p>5. Use offline methods to generate password guesses against a partial hash.<p>The end result: A timing attack that consequently allows an optimized offline guess. So even if their entire codebase is immune to SQL injection, you can still launch a semi-blind cracking attempt against them.