Where are Confluence user credentials stored, and how can an attacker modify them to gain unauthorized access?

User credentials are stored in the `CWD_USER` table within the Confluence database. An attacker with database access can modify the `credential` column to a known hash, such as `{PKCS5S2}UokaJs5wj02LBUJABpGmkxvCX0q+IbTdaUfxy1M9tVOeI38j95MRrVxWjNCu6gsm` (which corresponds to plaintext password `123456`), using an UPDATE SQL command. This technique is an exploitation approach described in the Confluence Usage Guide and is similar to other database-level attacks seen in vulnerability debugging setups like GoAnywhere MFT.