A Host Header Injection vulnerability in CraftMyCMS 4.0.2.2 allows unauthenticated attackers to conduct phishing or account takeover attacks by manipulating password reset links.

The application insecurely uses the HTTP Host header to construct password reset URLs, allowing an unauthenticated attacker to inject malicious hostnames into emails sent to users.

This vulnerability poses a significant risk to user account integrity and organizational security. Because the flaw facilitates the delivery of malicious password reset links, it can lead to full account takeover or credential harvesting, potentially resulting in unauthorized access to sensitive business data and reputational damage. The CVSS score of 7.1 highlights a High severity, primarily due to the potential for impacting the availability and integrity of user accounts.

Immediate Action: Since no official patch is currently identified, administrators should restrict access to the password reset endpoint if possible or implement input validation to ensure the Host header matches an expected, hardcoded domain.

Proactive Monitoring: Review web server access logs for anomalous HTTP Host header values, specifically those that deviate from the expected domain of the CMS installation.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize requests containing suspicious Host headers before they reach the application logic.

Public Exploit Available: Yes, a published proof-of-concept exists; it is attributed to the security researcher's write-up hosted on GitHub.

Given the availability of a public proof-of-concept and the high impact on account security, this vulnerability should be treated with urgency. Administrators must implement strict Host header validation as a defensive measure until the vendor releases an official security update to address the root cause in the application code.