CVE-2022-38796 - Feehi CMS 2.1.1 Host Header Injection

Researcher

This vulnerability was discovered by @yuyudhn.

Description

A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset emails.

Proof of Concept

Change the Host header when request to reset password endpoint. Then check your email for reset password link.

• https://www.youtube.com/watch?v=k8dp0FJnSsI

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-38796
• https://www.tenable.com/cve/CVE-2022-38796