CVE-2011-3189

CVE-2011-3189 describes a vulnerability in PHP 5.3.7 where the crypt function, when using the MD5 hash type, incorrectly returns the salt instead of the hashed string. This flaw could allow remote attackers to bypass authentication by providing an arbitrary password. The vulnerability has a CVSS score of 4.3 (Medium severity), indicating a network-based attack with medium complexity and potential for partial confidentiality impact. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in CISA's KEV catalog, though it has received some community discussion.