Critical · published August 19, 2025
🚨 A single endpoint can hand over the keys to your castle! Cicool builder 3.4.4 has a critical flaw that allows attackers to reset the administrator's password without breaking a sweat! 🔥 Think of it like a hotel where anyone can walk up to the front desk and ask for a new key card, no ID required. Just like that, this vulnerability lets attackers take control of your site without any real credentials. Imagine the chaos if an attacker gains access to your admin account! They could change settings, delete content, or even lock out legitimate users. This isn't just a minor annoyance; it's a gateway to total control of your system.
Think of it like a hotel where anyone can walk up to the front desk and ask for a new key card, no ID required. Just like that, this vulnerability lets attackers take control of your site without any real credentials. This vulnerability arises from a lack of proper authentication checks on the /administrator/auth/reset_password endpoint, allowing unauthorized users to reset the admin password at will.
Imagine the chaos if an attacker gains access to your admin account! They could change settings, delete content, or even lock out legitimate users. This isn't just a minor annoyance; it's a gateway to total control of your system. Immediate action is required: Update Cicool builder to version 3.4.5, which addresses this issue. Additionally, implement stronger authentication checks and review access controls to prevent unauthorized access in the future. You've got this! Follow these steps, and you'll secure your site in no time. 🛡️