Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote). The affected component is the file forg…

Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote). The affected component is the file forgot_pwd.php - it uses a weak algorithm for the generation of password recovery tokens (the PHP uniqueid function), allowing a brute force attack.