PT-2025-4762 · Ctfd · Ctfd

H + 3 · Published 2025-01-31 · Updated 2025-02-21 · CVE-2025-23001

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CTFd version 3.7.5

Description A Host Header Injection issue exists due to the application's failure to properly validate or sanitize the Host header. This allows an attacker to manipulate the Host header in HTTP requests, potentially leading to phishing attacks, password reset, or cache poisoning.

Recommendations For CTFd version 3.7.5, as a temporary workaround, consider implementing proper validation and sanitization of the Host header to prevent manipulation. However, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-644

CWE-89

Related Identifiers

CVE-2025-23001

Affected Products

Ctfd

References · 8

• https://osv.dev/vulnerability/CVE-2025-23001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-23001 · Security Note
• https://github.com/CTFd/CTFd · Note
• https://codetoanbug.com/poc-cve-2025-23001-ctfd-english · Note
• https://blog.ctfd.io/ctfd-3-7-6 · Note
• https://t.me/cvenotify/111968 · Telegram Post
• https://t.me/cvedetector/16957 · Telegram Post
• https://twitter.com/CVEnew/status/1885375570201964631 · Twitter Post