# CVE-2024-53472:CSRF in control.php to change password
# Vendor
WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.
[https://www.wegia.org](https://www.wegia.org/)
[https://sol.sbc.org.br/index.php/latinoware/article/view/31544](https://sol.sbc.org.br/index.php/latinoware/article/view/31544)
## Affected Product Code Base
WeGIA < v3.2.0
# Vulnerability Description
A Cross-Site Request Forgery (CSRF) vulnerability was identified in the WeGIA application. This flaw enables an attacker to induce an authenticated user to perform unintended actions without their consent or awareness.
# POC
This code allows an attacker to change the password of an authenticated user without their consent by loading this malicious page while the user is logged into the application.
```html
CSRF Exploit
```
# Reference
# Reference
[https://www.cve.org/CVERecord?id=CVE-2024-53472](https://www.cve.org/CVERecord?id=CVE-2024-53472)
# Solution
[https://github.com/nilsonLazarin/WeGIA/issues/790](https://github.com/nilsonLazarin/WeGIA/issues/790)
# Discoverer
[Natan Maia Morette](https://nmmorette.github.io)
by [CVE-Hunters](https://github.com/Sec-Dojo-Cyber-House/cve-hunters)