Description
Beehive Forum 1.5.2 contains a host header injection vulnerability in the forgot password functionality that allows attackers to manipulate password reset requests. Attackers can inject a malicious host header to intercept password reset tokens and change victim account passwords without direct authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Beehive Forum | Beehive Forum | 1.5.2 | — |
References
- ExploitDB-50923 exploit
- Beehive Forum Official Website product
- Beehive Forum SourceForge Project product
- Proof of Concept Imgur exploit
- VulnCheck Advisory: Beehive Forum - Account Takeover third-party-advisory