CraftMyCMS Host Header Injection Vulnerability in Password Reset Functionality

A Host Header Injection vulnerability has been identified in CraftMyCMS version 4.0.2.2, specifically within the password reset feature. The vulnerability arises because the application directly uses the Host header from the server variables to create password reset links sent via email. This allows attackers to manipulate the Host header and craft malicious reset links, potentially leading to phishing attacks or account takeover.

Impact

Exploitation of this vulnerability could result in phishing attacks, interception of password reset tokens, and unauthorized account access by redirecting victims to attacker-controlled domains.

Reproduction

To reproduce this vulnerability, send a POST request to the password reset endpoint, including a malicious Host header. This will inject the harmful link into the password reset process.