LaraDashboard CVE-2025-66509

Requires the application's admin password-reset flow to be reachable and for an admin reset to be triggered (attacker-initiated against a known admin email, or awaiting a legitimate one); the attacker supplies a crafted Host header so the generated reset link points to their server. Token capture typically depends on the administrator interacting with the poisoned email link or an email client prefetching it - a real limiting factor the vendor's UI:N rating omits. Achieving RCE additionally requires the module-upload feature to be usable after the resulting admin takeover; in 2.3.0 and earlier uploaded modules could execute immediately, which the patch closes by defaulting new modules to disabled and blocking overwrite of existing module names.

This is a genuinely high-impact chain - Host-header injection in the admin password-reset flow (confirmed by the commit swapping url(route(...)) for config('app.url')) leaks the admin reset token to an attacker-controlled host, and the module-upload feature then auto-executes ServiceProvider::boot() for full PHP RCE (CVSS 4.0 VC:H/VI:H/VA:H). The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, score 8.9) rates it as remotely exploitable by an unauthenticated attacker with no user interaction, but this conflicts with the mechanics of reset-poisoning: capturing the token realistically depends on an admin-initiated reset and the admin interacting with (or a client prefetching) the poisoned link, so AC:L/UI:N likely understates attack complexity and interaction requirements. Countervailing signals lower real-world urgency: EPSS is only 0.11% (29th percentile), the CVE is NOT in CISA KEV, and the affected product is a niche open-source Laravel starter kit with a small deployment footprint. The CVSS 4.0 threat metric E:P indicates proof-of-concept exploit maturity, but no public exploit URL is present in the references. Net: a serious, patch-worthy flaw for anyone actually running LaraDashboard ≤2.3.0, but low predicted mass exploitation - treat as high priority for affected operators, not an emergency fleet-wide fire drill.

An attacker submits a password-reset request for the administrator account while injecting a forged Host header, causing the reset email to contain a link pointing to an attacker-controlled server. When the admin interacts with the poisoned link (or a mail client prefetches it), the reset token is captured by the attacker, who resets the admin password, logs in, and uploads a malicious module whose ServiceProvider::boot() method executes arbitrary PHP. No public exploit URL is referenced, though the CVSS 4.0 threat metric E:P indicates proof-of-concept maturity.