GHSA-p757-4v3p-j74f

Known vulnerable to account takeover via host header injection attack in v1.3.1

Source: GitHub Advisory Database (reviewed) High CVE-2022-33011

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	idno/known	<= 1.3.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Known v1.3.1 was discovered to allow attackers to perform an account takeover via a host header injection attack. The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x branch is currently on the `dev` branch of the idno/known repository.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-33011 advisory
https://blog.jitendrapatro.me/multiple-vulnerabilities-in-idno-known-php-cms-software web
https://github.com/idno/known package
https://github.com/idno/known/blob/dev/composer.json#L4 web
https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Account%20Takeover#account-takeover-through-password-reset-poisoning web
https://www.pethuraj.com/blog/how-i-earned-800-for-host-header-injection-vulnerability web