← back
CVE-2016-10073

CVE-2016-10073

EPSS 83.6%
The from method in library/core/class.email.php in Vanilla Forums before 2.3.1 allows remote attackers to spoof the email domain in sent messages and potentially obtain sensitive information via a crafted HTTP Host header, as demonstrated by a password reset request.
Affected products
n/a · n/a
public PoCs found — 3
cve_referencepacketstormsecurity.com/files/142486/Vanilla-Forums-2.3-Remote-Code-Execution.htmlunverifiedcve_referencewww.exploit-db.com/exploits/41996/unverifiedexploitdbwww.exploit-db.com/exploits/41996unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://packetstormsecurity.com/files/142486/Vanilla-Forums-2.3-Remote-Code-Execution.htmlhttps://exploitbox.io/vuln/Vanilla-Forums-Exploit-Host-Header-Injection-CVE-2016-10073-0day.htmlhttps://open.vanillaforums.com/discussion/33498/critical-security-release-vanilla-2-3-1https://www.exploit-db.com/exploits/41996/