Critical · published March 27, 2025
🚨 A sneaky flaw in WeGIA allows attackers to reset any user’s password, including admin accounts, without breaking a sweat! 🔥 Think of it as a hotel where anyone can walk up to the front desk and change the room key without showing any ID — that’s how easy it is for unauthorized users to take over accounts here! This is absolutely devastating! An attacker could easily lock out legitimate users, change any password they want, and stroll into sensitive accounts, potentially exposing confidential data and wreaking havoc on charity operations. It's a nightmare waiting to happen!
Think of it as a hotel where anyone can walk up to the front desk and change the room key without showing any ID — that’s how easy it is for unauthorized users to take over accounts here! The vulnerability lies in the control.php endpoint, which fails to verify the old password before allowing a new password to be set. This critical oversight means attackers can bypass authentication entirely, gaining unauthorized access to user accounts.
This is absolutely devastating! An attacker could easily lock out legitimate users, change any password they want, and stroll into sensitive accounts, potentially exposing confidential data and wreaking havoc on charity operations. It's a nightmare waiting to happen! To protect your organization, patch WeGIA immediately to version 3.2.6. Ensure all users are aware of this issue and recommend a password reset to maintain security. It’s vital to review your security policies to prevent similar vulnerabilities in the future! You've got this! By taking these steps, you'll shield your organization from this vulnerability in no time. 🛡️