Wonder CMS 2.3.1 - 'Host' Header Injection
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | Wonder CMS 2.3.1 - Host Header Injection Vulnerability | 5 Feb 201800:00 | – | zdt |
 | WonderCMS HTTP Host Header Injection Vulnerability | 29 Jan 201800:00 | – | cnvd |
 | CVE-2017-14523 | 26 Jan 201820:00 | – | cve |
 | CVE-2017-14523 | 26 Jan 201820:00 | – | cvelist |
 | Wonder CMS 2.3.1 - Host Header Injection | 5 Feb 201800:00 | – | exploitpack |
 | CVE-2017-14523 | 26 Jan 201820:29 | – | nvd |
 | Wonder CMS 2.3.1 Host Header Injection | 5 Feb 201800:00 | – | packetstorm |
 | Design/Logic Flaw | 26 Jan 201820:29 | – | prion |
 | PT-2018-5679 · Wondercms · Wondercms | 26 Jan 201800:00 | – | ptsecurity |
 | CVE-2017-14523: Improper Neutralization of Special Elements in Output Used by a Downstream Component | 26 Jan 201800:00 | – | rapid7 |
# Exploit Title: Wonder CMS 2.3.1 Host Header Injection
# Date: 30-01-2018
# Exploit Author: Samrat Das
# Contact: http://twitter.com/Samrat_Das93
# Website: https://securitywarrior9.blogspot.in/
# Vendor Homepage: https://www.wondercms.com/
# Version: 2.3.1
# CVE : CVE-2017-14523
# Category: Webapp CMS
1. Description
The application allows illegitimate host header manipulation and leads to aribtary web page re-direction. This can also lead to severe attacks such as password reset or web cache poisoning
2. Proof of Concept
Intercept any web request of cms using a proxy tool.
Change the http host header to:
POST / HTTP/1.1
Host: google.com
You can observe the page being re-directed and the Location header changed in response to: http://www.google.com/
3. Solution:
To Mitigate host header injections allows only a whitelist of allowed hostnames.Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
05 Feb 2018 00:00Current
7.3High risk
Vulners AI Score7.3
CVSS 25
CVSS 37.5
EPSS0.08045