Unauthenticated Password Reset via User/forgot3.php Leading to Account Takeover

Vulnerability Overview Title: Any user's password can be reset via (No session, No token, No email verification) Summary: executes by taking data directly from , without verifying that the requester owns the provided email address. Combined with CVE-17 (passwords stored in plaintext), creates a complete account takeover chain when combined with . An attacker can select the victim's email, set a password, and then log in using it. The laboratory demonstrated this by changing the password for to and successfully logging in. Affected Versions: Commit: Vulnerability Type: Unverified password change / Critical functionality lacking authentication Affected Code: File: Root Cause: The endpoint is intended to serve as the target for a password recovery form ( ), but nothing binds it to that process. There is no shared token, the check ( ) only prevents logged-in users, there is no email fallback, and no request token. The clause trusts any provided email address. Because passwords are stored in plaintext (CVE-17), the statement becomes a primitive for full account takeover. Reproduction Steps: 1. Reset the password for to from a completely anonymous client: Observe the response: 2. Confirm the password in the database: Observe: 3. Log in as the victim using the attacker-chosen password: Observe (session setup, ): 4. Attempt to perform the same action against an administrator (since the email column is the same as , account takeover is direct). Note that SQL only targets the table: Impact: Full account takeover for any registered user with just one unauthenticated POST request. The attacker selects a new password and logs in immediately. Since these pages also accept any logged-in (CVE-12), exploiting this primitive against the user table, where the email matches the administrator, or in combination with CVE-14's authentication bypass, can result in administrator-level access. The "recovery" process also resets all rows with the same email (no unique constraint at the application layer). CVSS 3.1 Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8 (Critical) Scope of Impact All registered users, including administrator accounts. Remediation Add session validation, token validation, and email verification during the password reset process. Ensure passwords are stored in an encrypted form, not in plaintext. Implement strict input validation and exception handling for password reset requests.

Goal Reached Thanks to every supporter — we hit 100%!

Unauthenticated Password Reset via User/forgot3.php Leading to Account Takeover

More from this source