PT-2025-42478 · Unknown · Craftmycms

Published 2025-10-16 · Updated 2025-10-16 · CVE-2025-61543

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions CraftMyCMS version 4.0.2.2

Description A Host Header Injection issue exists in the password reset functionality. The system directly uses $ SERVER['HTTP HOST'] to create password reset links sent through email. An attacker can manipulate the Host header to send malicious reset links, potentially leading to phishing attacks or account takeover. The vulnerable parameter is $ SERVER['HTTP HOST'].

Recommendations Apply a fix that properly sanitizes or encodes the $ SERVER['HTTP HOST'] variable before using it to construct password reset links.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-61543

Affected Products

Craftmycms

References · 6

• 🔥 https://github.com/bugdotexe/Vulnerability-Research/tree/main/CVE-2025-61543 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-61543 · Security Note
• https://t.me/CVEtracker/35098 · Telegram Post
• https://twitter.com/CVEnew/status/1978932575554146697 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1978908040817451337 · Twitter Post
• https://owasp.org/www-community/vulnerabilities/HTTP_Host_header_injection · Note