Tiandy Easy7 Integrated Management Platform Unauthenticated Password Reset Vulnerability

A vulnerability in Tiandy Easy7 Integrated Management Platform version 7.17.0 allows for unauthenticated password reset through the API endpoint /rest/user/updateUserPassword. This remote exploitation can lead to weak password recovery. The vulnerability has been publicly disclosed and is actively exploitable.

Impact

Exploitation of this vulnerability allows for unauthorized password resets, potentially leading to unauthorized access to user accounts.

Reproduction

To exploit this vulnerability, send a POST request to the /Easy7/rest/user/updateUserPassword endpoint. The request should include the userId parameter set to 'admin', along with a new password. No authentication or authorization headers are required.