GHSA-hqp9-mrjw-7qq2
Economizzer host header injection vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | gugoan/economizzer | <= 0.9-beta1 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This allows an attacker to reset other users' passwords.
References
External links from the advisory. They lead to third-party sites.