[kh99]

You could edit file includes/functions.php and change the function fetch_random_password(), but that's also used by the mobile api so I don't know what affect that would have. It's also a kind of strange function that generates a string of random characters but seems to have been modified to insert one digit in a random place or something like that.

Or you could edit admincp/passwordcheck.php and where fetch_random_password() is called, substitute your own code. That's where the vulnerable password check happens, if the user requests a change that's done in login.php.