CVE-2017-7725

MEDIUM

concrete5 8.1.0 - Cross-Site Scripting via Host Header Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-7725. PoCs published by hyp3rlinx.

AI-analyzed exploit summary This exploit demonstrates a Host Header Injection vulnerability in concrete5 v8.1.0, allowing unauthenticated attackers to inject malicious links into the database by manipulating the Host header. The PoC shows how this can lead to redirection to an attacker-controlled site.

Description

concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored and allows for arbitrary domains to be set for certain links displayed to subsequent visitors, potentially an XSS vector.

Exploits (1)

exploitdb WORKING POC VERIFIED
by hyp3rlinx · textwebappsphp
https://www.exploit-db.com/exploits/41885

This exploit demonstrates a Host Header Injection vulnerability in concrete5 v8.1.0, allowing unauthenticated attackers to inject malicious links into the database by manipulating the Host header. The PoC shows how this can lead to redirection to an attacker-controlled site.

Classification
Working Poc 100%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: concrete5 v8.1.0
No auth needed
Prerequisites: concrete5 v8.1.0 installation without a canonical URL specified
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/41885/
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
https://packetstormsecurity.com/files/142145/concrete5-8.1.0-Host-Header-Injection.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/97649
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
https://hackerone.com/reports/148300

Scores

CVSS v3 6.1
EPSS 0.0362
EPSS Percentile 88.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
concrete5/concrete5 0Packagist
concretecms/concrete_cms 8.1.0
Published Apr 13, 2017
Tracked Since Feb 18, 2026