-
Murali kamal
- PowerBuilder
- Thursday, 29 October 2026 12:43 PM UTC
Hi Team,
Our security team has raised concerns regarding the security of our PowerBuilder-based application under the following two scenarios:
1) Authentication Bypass:
A security vulnerability was identified in the PowerBuilder thick client that allows an unauthenticated attacker to bypass the login prompt by modifying compiled PBD files. The authentication SQL query stored in plain text within the PBD file can be altered to bypass password verification, enabling an attacker to log in as any valid user without a password.
Fig: A comparison of the manipulated file [left] and the legitimate file [Right]
Note: The attached image is viewed through Hexa viewer of the PBD file
Where in the manipulated file (Left image), the plain text is replaced with empty spaces, to authorise this authentication bypass
2) Password Disclosure:
A non-privileged Windows user can bypass the default administrative restrictions by copying the thick client application directory to a user-writable location and modifying the configuration file to redirect database authentication to a rogue MSSQL server, potentially exposing database credentials in plain text.
Note: Here an exploitation tool called Metasploit was installed in controlled remote server, and the “auxiliary/server/capture/mssql” module was used to setup a fake MSSQL service.
Fig 1 :Cmd prompt showing the user isn’t privileged, followed by the command to copy files 
Fig 2: Resulting file ACLs after copy operation
Fig 3: Metasploit module capturing plain text SQL credentials 
This issue arises from the systemic issue of the thick client, which is under end user control, requiring extensive access of the database.
Tools that we use and other infromation:
1) Power Builder 2022 R3
2) MSSQL - Windows Server 2022
3) SHA256 - For password Hashing
4) From client side, not all customer use Citrix environment rather some use thick client setup installed using .msi file.
Questions:
1) Is there any recommended solution from the PowerBuilder side to prevent configuration file modification and authentication bypass?
2) Will implementing DPAPI using crypt32.dll for encryption and decryption help resolve these security issues?
3) Is it possible to protect the authentication logic in compiled PBD files from being modified or reverse-engineered?
We would appreciate your guidance on the recommended PowerBuilder solutions to address these security concerns.
Thanks in advance for your time and support.
Find Questions by Tag
Helpful?
If a reply or comment is helpful for you, please don’t hesitate to click the Helpful button. This action is further confirmation of their invaluable contribution to the Appeon Community.