Executive Summary

This vulnerability is a Host Header Injection in the /register and /confirm-email endpoints of the Drawing-Captcha APP. It allows an attacker to manipulate the Host header in HTTP requests to generate malicious email confirmation links that redirect users to attacker-controlled domains.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact users by allowing attackers to send malicious email confirmation links that redirect users to attacker-controlled domains, potentially leading to phishing attacks or unauthorized access during account registration or verification.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the Drawing-Captcha APP to version 1.2.5-alpha-patch or later, where the Host Header Injection vulnerability has been fixed.

Useful 0 Not Useful 0