CVE-2023-53958

HIGH

LDAP Tool Box Self Service Password 1.5.2 - SSRF

Title source: llm

Description

LDAP Tool Box Self Service Password 1.5.2 contains a password reset vulnerability that allows attackers to manipulate HTTP Host headers during token generation. Attackers can craft malicious password reset requests that generate tokens sent to a controlled server, enabling potential account takeover by intercepting and using stolen reset tokens.

Exploits (1)

exploitdb WRITEUP

by Tahar BENNACEF · textwebappsphp

https://www.exploit-db.com/exploits/51275

View Code ZIP pw:eip

References (3)

[Various Sources] https://github.com/ltb-project/self-service-password

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/51275

[Third Party Advisory] https://www.vulncheck.com/advisories/ldap-tool-box-self-service-password-account-takeover-via-http-host-header

Scores

CVSS v3 7.5

EPSS 0.0006

EPSS Percentile 17.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-640

Status published

Products (1)

ltb-project/LDAP Tool Box Self Service Password 1.5.2

Published Dec 19, 2025

Tracked Since Feb 18, 2026