Marcelo Ardiles

**Name of the Vulnerable Software and Affected Versions** Gestsup versions prior to 3.2.10 **Description** The issue allows for account takeover through the password recovery functionality remotely. It is caused by a weak algorithm used for generating password recovery tokens in the forgot pwd.php file, specifically the PHP uniqueid function. This weakness enables a brute force attack. **Recommendations** For versions prior to 3.2.10, update to version 3.2.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the forgot pwd.php file to minimize the risk of exploitation. Avoid using the password recovery functionality until the issue is resolved.