WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because the attack can only come from a local machine or from the administrator as a self attack
References
| Link | Resource |
|---|---|
| https://securitywarrior9.blogspot.in/2018/01/host-header-injection-in-wonder-cms.html | Exploit Third Party Advisory |
| https://www.exploit-db.com/exploits/43964/ | Exploit Third Party Advisory VDB Entry |
Configurations
History
07 Nov 2023, 02:39
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because the attack can only come from a local machine or from the administrator as a self attack |
Information
Published : 2018-01-26 20:29
Updated : 2024-08-05 20:15
NVD link : CVE-2017-14523
Mitre link : CVE-2017-14523
CVE.ORG link : CVE-2017-14523
JSON object : View
Products Affected
wondercms
- wondercms
CWE
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')