CVE-2021-31646

Name of the Vulnerable Software and Affected Versions Gestsup versions prior to 3.2.10

Description The issue allows for account takeover through the password recovery functionality remotely. It is caused by a weak algorithm used for generating password recovery tokens in the forgot pwd.php file, specifically the PHP uniqueid function. This weakness enables a brute force attack.

Recommendations For versions prior to 3.2.10, update to version 3.2.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the forgot pwd.php file to minimize the risk of exploitation. Avoid using the password recovery functionality until the issue is resolved.