ContiNew Admin Unverified Password Change Vulnerability

A vulnerability allowing unverified password changes has been identified in ContiNew Admin versions through 3.6.0. The issue arises from an unknown functionality in the file '/dev-api/system/user/1/password', which can be manipulated to change passwords without proper verification. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for unauthorized password changes, potentially leading to unauthorized access or privilege escalation.

Reproduction

To reproduce this vulnerability, send a request to the '/dev-api/system/user/1/password' endpoint. The request should include the new password, but no verification of the password change will be performed. This can be done remotely, and the vulnerability affects the super-administrator account.