published November 13, 2020
NVD has not assigned a CVSS score to this record. It sits in the 99.6th percentile for exploit probability.
⚠️ A sneaky flaw in rConfig allows for the creation of admin accounts without proper authentication! 🚨 It's like a restaurant that accidentally leaves the back door wide open, letting anyone stroll in and take charge of the kitchen, no questions asked! This could lead to unauthorized users gaining full control over your system, potentially exposing sensitive data or making unauthorized changes. If malicious actors exploit this hole, it could result in an absolutely devastating security breach and compromise the integrity of your entire setup!
It's like a restaurant that accidentally leaves the back door wide open, letting anyone stroll in and take charge of the kitchen, no questions asked! An authentication bypass vulnerability in userprocess.php of rConfig 3.9.x (before 3.9.7) enables attackers to create administrator accounts without needing valid credentials, effectively bypassing security measures.
This could lead to unauthorized users gaining full control over your system, potentially exposing sensitive data or making unauthorized changes. If malicious actors exploit this hole, it could result in an absolutely devastating security breach and compromise the integrity of your entire setup! Update to rConfig version 3.9.7 or later immediately to patch this vulnerability. It's also wise to review your system for any unauthorized changes or accounts that may have been created during the window of vulnerability. You've got this! Just follow the steps and your security will be back on track in no time! 🛡️