vendor:
SISQUALWFM
by:
Omer Shaik
5.1
CVSS
MEDIUM
Host Header Injection
20
CWE
Product Name: SISQUALWFM
Affected Version From: 7.1.319.103
Affected Version To: 7.1.319.103
Patch Exists: YES
Related CWE: CVE-2023-36085
CPE: a:sisqual:sisqualwfm:7.1.319.103
Platforms Tested: SISQUAL WFM 7.1.319.103
2023
SISQUALWFM 7.1.319.103 Host Header Injection
A proof-of-concept scenario showcasing a host header injection vulnerability in sisqualWFM version 7.1.319.103, particularly targeting the /sisqualIdentityServer/core endpoint. Exploiting this flaw could allow an attacker to manipulate webpage links or redirect users to malicious sites by altering the host header.
Mitigation:
To mitigate this vulnerability, ensure that input validation is performed on the host header to prevent malicious manipulation. Additionally, consider implementing secure coding practices and utilizing security mechanisms like Content Security Policy (CSP) to mitigate risks.
