> For the complete documentation index, see [llms.txt](https://blog.be-hacktive.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.be-hacktive.com/eskooly-cve/cve-2024-27715-inadequate-password-update-verification-in-eskooly-web-product-less-than-v3.0.md).

# CVE-2024-27715 - Inadequate Password Update Verification in Eskooly Web Product <= v3.0

<figure><img src="/files/hs8A48hSGYhtORKaZgfs" alt=""><figcaption></figcaption></figure>

## Introduction

Eskooly application's current process for updating passwords is insufficiently secure, as it only requires users to enter a new password and its confirmation, without asking for the current (old) password.

### Related Findings

* Broken Authentificaton
  * Weak password
  * Brute Force
  * Inadequate Password Update Verification

### **Technical Details**

1. Update Admin password

<figure><img src="/files/9zcRWrZiaiR5ng7fMiyC" alt=""><figcaption></figcaption></figure>

2. Update Teacher/Student

<figure><img src="/files/vxg4380cmOe4Tkf8cZHl" alt=""><figcaption></figcaption></figure>

## Risk&#x20;

### Impact

**High.**&#x20;

Given that the application hold critical and sensitive data, the impact of this vulnerability is extremely High. Successful exploitation allows attackers full access to all stored credentials, leading to potential identity theft and unauthorized access to various services. The ability to change passwords without the original one could lead to account takeovers and significant data breaches.

### Likelihood&#x20;

**High.**

The likelihood is medium because to exploit this vulnerability, the attacker must have access to the victim's current session, e.g. the victim has left his browser session open. The attacker will therefore be able to modify the victim's password without knowing the original.

## Recommendation

It is recommended to enhance the password update process by requiring users to input their current password before setting a new one. This step adds a crucial verification layer to ensure that only authorized users can change passwords.

## **References**

* [**A07:2021 – Identification and Authentication Failures** ](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)
* [**CWE-620: Unverified Password Change**](https://cwe.mitre.org/data/definitions/620.html)