Raytha CMS Header Spoofing Vulnerability Leading to Account Takeover

A vulnerability in Raytha CMS prior to version 1.4.6 allows an attacker to spoof the 'X-Forwarded-Host' or 'Host' headers, directing them to an attacker-controlled domain. By knowing the victim's email address, the attacker can manipulate the server into sending a password reset email with a link pointing to the spoofed domain. When the victim clicks the link, their browser sends a request to the attacker's domain with a token in the path, enabling the attacker to capture the token. This token can then be used to reset the victim's password and gain access to their account.

Impact

Exploitation of this vulnerability allows for unauthorized password resets, leading to account takeover.

Remediation

Users can upgrade to Raytha CMS version 1.4.6 or later to address this vulnerability.