PT-2021-23843 · Unknown · Sourcecodester Engineers Online Portal

Published 2021-12-20 · Updated 2022-01-03 · CVE-2021-43437

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sourcecodetester Engineers Online Portal (affected versions not specified)

Description The issue allows an attacker to manipulate the Host header, causing the web application to behave in unexpected ways. This is particularly relevant when multiple websites are hosted on the same IP address, where the Host header specifies which website should process the HTTP request. The web server uses this header to dispatch the request to the specified website, and it is possible to send requests with arbitrary Host headers to the first virtual host.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2021-43437

Affected Products

Sourcecodester Engineers Online Portal

References · 6

• 🔥 https://medium.com/@mayhem7999/cve-2021-43437-5c5e3b977e84 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-43437 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43437 · Vendor Advisory
• https://portswigger.net/web-security/host-header · Note
• https://medium.com/%40mayhem7999/cve-2021-43437-5c5e3b977e84 · Note
• https://t.me/cibsecurity/34297 · Telegram Post