PT-2025-47370 · Unknown · Backdrop Cms

Published 2025-11-18 · Updated 2025-11-24 · CVE-2025-63828

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Backdrop CMS version 1.32.1

Description A Host Header Injection flaw exists in Backdrop CMS. This issue allows attackers to manipulate the Host header within password reset requests. Successful exploitation can lead to redirection to malicious domains and potential session hijacking through cookie injection. The vulnerability impacts the handling of the Host header during password reset functionality.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider implementing strict Host header validation to prevent manipulation of the Host header.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-63828

GHSA-FFPG-GM3H-4P5P

Affected Products

Backdrop Cms

References · 7

• 🔥 https://github.com/mertdurum06/BackdropCms-1.32.1/blob/main/backdropcms_exploit.txt · Exploit
• https://osv.dev/vulnerability/CVE-2025-63828 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63828 · Security Note
• https://github.com/mertdurum06/BackdropCms-1.32.1 · Note
• https://t.me/cveNotify/143787 · Telegram Post
• https://twitter.com/CVEnew/status/1991066238324539803 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1p1gf2n/resumen_diario_de_vulnerabilidades_19112025 · Reddit Post