Threats tagged 'ghsa-w6f7-3p76-2m93'

Control Web Panel (CWP) versions prior to 1.30.6 have a host header injection vulnerability in the password recovery process. This flaw allows unauthenticated attackers to manipulate the HTTP Host header in the /v1/lostpass/ route, poisoning the reset URL. By tricking an automated mail-security scanner into visiting this malicious link, attackers can exfiltrate the live recovery token, use it to reset the password, and then abuse File Manager and Crontab modules to execute commands under the targeted hosting account.