Where are Confluence user credentials stored, and how can an attacker modify them to gain unauthorized access?

User credentials are stored in the `CWD_USER` table within the Confluence database. An attacker with database access can modify the `credential` column to a known hash, such as `{PKCS5S2}UokaJs5wj02LBUJABpGmkxvCX0q+IbTdaUfxy1M9tVOeI38j95MRrVxWjNCu6gsm` (which corresponds to plaintext password `123456`), using an UPDATE SQL command. This technique is an exploitation approach described in the [Confluence Usage Guide](/news/confluence-usage-guide) and is similar to other database-level attacks seen in vulnerability debugging setups like [GoAnywhere MFT](/news/setting-up-goanywhere-managed-file-transfer-vulnerability-debugging-environment).