PHP : Untrusted HTTP_HOST source

The application uses the HTTP_HOST variable, whose value is derived from the request header. An attacker can replace the value of this variable.

Variable HTTP_HOST returns the contents of the Host header from the current request, if there is one. The value of the variable can be changed by sending a different Host header when accessing the website. The attacker may perform phishing attack or cache poisoning.