A critical vulnerability in Daylight Studio FuelCMS allows unauthenticated attackers to perform password reset poisoning, potentially leading to unauthorized account takeover.

This flaw exists within the password reset mechanism where the application fails to validate the host header during the reset process. An unauthenticated attacker can manipulate the reset link, causing the application to send a password reset token to an attacker controlled endpoint.

The ability for an unauthenticated attacker to intercept password reset tokens poses a significant risk to user account integrity. By successfully capturing these tokens, an attacker can reset user passwords, leading to unauthorized access to sensitive data and potential full account compromise. With a CVSS score of 7.1, this high severity vulnerability necessitates immediate attention to prevent identity theft and maintain system trust.

Immediate Action: Monitor vendor communication channels for the release of a security patch and apply it immediately upon availability.

Proactive Monitoring: Review application access logs for suspicious password reset requests, particularly those originating from unknown or external IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect incoming HTTP requests for malicious host header manipulation.

Public Exploit Available: Yes, a published PoC exists, attributed to the technical write-up referenced in the CVE record.

Given the potential for complete account takeover, organizations utilizing FuelCMS v1.5.2 must prioritize this issue. Administrators should verify their current version and implement restrictive WAF rules to block malformed host headers until an official vendor patch is deployed. Failure to address this vulnerability exposes the user base to significant risk of unauthorized access.