Critical · published September 19, 2025
🚨 Danger lurks in the Docker containers! A script in Vasion Print can reset your entire database root password with just a single request, and it doesn't even require authentication! 🔥 Think of it like a restaurant where the chef leaves the kitchen door wide open and leaves the recipe book on the counter — anyone can just waltz in, change the secret sauce, and serve whatever they want without anyone checking their ID. An attacker exploiting this vulnerability could simply reset the MySQL root password to 'password', gaining full control over your database. With access to sensitive information, they could manipulate data, steal credentials, or even take complete control of your system — an absolutely devastating blow to your security!
Think of it like a restaurant where the chef leaves the kitchen door wide open and leaves the recipe book on the counter — anyone can just waltz in, change the secret sauce, and serve whatever they want without anyone checking their ID. This vulnerability in Vasion Print arises from a lack of authentication checks in the /var/www/app/resetroot.php script, allowing attackers to perform a SQL update to reset the database administrator credentials. Additionally, the unserialize vulnerability in the common/oses.php file could enable remote code execution if accessed with controlled serialized data.
An attacker exploiting this vulnerability could simply reset the MySQL root password to 'password', gaining full control over your database. With access to sensitive information, they could manipulate data, steal credentials, or even take complete control of your system — an absolutely devastating blow to your security! Patch immediately to versions 22.0.843 or later for the Virtual Appliance Host, and ensure the Application version is updated to 20.0.1923 or later. Review your Docker configurations and harden the access controls to sensitive scripts. 🛡️ You've got this! Take these steps to lock down your systems and keep your data safe! 💪✨