Sachinart
Source-scoped identity with 11 associated PoCs and 11 linked vulnerabilities.
Exploit catalog results
Showing 11 PoCs on this page
GitHubSachinart/CVE-2026-60004-gitea-0day
Repository PoCStars: 0Created 2026-08-04ExploitCVE-2026-600042 files
Analysis
Technical assessment
A Python script that automates exploitation of CVE-2026-60004 in Gitea <= 1.27.0 to achieve pre-auth remote code execution via a diffpatch collision, establishing an interactive shell through the Gitea API.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python PoC script (poc.py) for CVE-2026-60004, a Gitea RCE. The script automates exploitation of the described vulnerability to obtain an interactive shell on a target Gitea instance. All behavior is consistent with the stated exploit purpose: it registers a user, creates a repository, plants a Git hook via a diffpatch collision, and uses the hook to execute attacker-supplied commands and return output through the Gitea API. No concealed, unrelated, or operator-directed harmful behavior (such as credential exfiltration, persistence outside the exploit chain, or unrelated payload delivery) was observed.
Classification basis and observed behavior
Classification basis
The artifact contains a complete, automated Python script (poc.py) that exercises the CVE-2026-60004 vulnerability to achieve remote code execution and provides an interactive shell. The README explicitly describes it as a 'proof-of-concept exploit' and the code performs the full exploitation chain.
README.md:4poc.py:1-8Requirements
- Target Gitea instance must have open registration enabled.
README.md:21 - Target must be running Gitea version 1.17 through 1.27.0.
README.md:4
Observed behavior
- Registers a new user account on the target Gitea instance.
poc.py:116-133 - Creates a private repository with auto-initialization.
poc.py:135-144 - Sends a malicious patch to the /diffpatch API endpoint to plant a post-index-change Git hook via an add/add collision.
poc.py:163-201 - Executes arbitrary commands on the server by writing them to a tracked file (cmd.sh) that the hook reads and executes.
poc.py:163-201 - Retrieves command output via the Gitea Raw API endpoint and provides an interactive shell.
poc.py:203-231
Behaviors behind the backdoor verdict
Observables
- Exploit Chain
- Payload withheldThe entire script implements the described CVE-2026-60004 exploit chain. No extraneous or concealed actions are present.
poc.py:233-238poc.py:163-201 - Hook Payload
- Payload withheldThe hook payload is the core of the exploit. It executes attacker commands and returns output, matching the described RCE mechanism.
poc.py:23-45 - Command Execution
- Payload withheldThe hook executes the content of cmd.sh, which is set by the attacker via the diffpatch API. This is the intended RCE primitive.
poc.py:36 - Output Retrieval
- Payload withheldThe script retrieves command output through the Gitea raw API, consistent with the documented API-driven shell approach.
poc.py:197-198
What the analysis did not establish
- Only the two text files (README.md and poc.py) were provided and reviewed. No binary files or external dependencies were present in the evidence.
- The review does not assess whether the exploit works as claimed or whether the target vulnerability exists.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubSachinart/CVE-2026-41940-cpanel-0day
Repository PoCStars: 22Created 2026-04-29ScannerCVE-2026-419402 files
Analysis
Technical assessment
A Python-based defensive posture scanner for cPanel/WHM that checks for exposure to the CVE-2026-41940 authentication bypass vulnerability. It performs unauthenticated network probes (DNS, TLS, HTTP) and optional SSH-based configuration audits to determine if the proxy-subdomain attack chain is reachable, but does not attempt to exploit the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The repository contains a defensive posture scanner for CVE-2026-41940. The Python script performs unauthenticated network probes and optional SSH-based configuration audits to assess exposure to the proxy-subdomain attack chain. No backdoor, deceptive payload, or concealed harmful behavior was observed. The code explicitly avoids sending credentials or performing exploitation.
Classification basis and observed behavior
Classification basis
The artifact is a scanner. The README explicitly states 'THIS IS A SCANNER REAL ONE' and the script's docstring declares 'cPanel defensive posture scanner' with 'No exploit attempts. No credentials sent.' The code only performs detection and validation checks (DNS, TLS, HTTP fingerprinting, SSH config audits) to assess exposure to CVE-2026-41940 without exercising the vulnerability.
README.md:13cpanel-0day.py:3-17Requirements
- Target hostname or IP address
cpanel-0day.py:1521-1524 - Python 3 with optional libraries (paramiko for SSH mode, requests, dnspython, cryptography)
cpanel-0day.py:32-58
Observed behavior
- Resolves proxy subdomains (cpanel, whm, webmail, webdisk) via DNS and checks HTTPS reachability on port 443
cpanel-0day.py:132-155 - Performs unauthenticated HTTP GET requests to / and /login/ on proxy subdomains to fingerprint cpsrvd indicators (Server header, security_token, cpsess, session cookies)
cpanel-0day.py:197-299 - Probes cpsrvd-specific URL patterns and WebDAV PROPFIND to confirm backend identity without credentials
cpanel-0day.py:360-415cpanel-0day.py:459-493 - Optionally connects via SSH to audit Apache modules, vhosts, ProxyPass rules, and header trust directives, and performs a passive proxy-hop verification using a single curl from the target
cpanel-0day.py:642-788 - Classifies targets into risk levels (SECURE, AT_RISK, EXPOSED) based on collected evidence and outputs results to console and CSV
cpanel-0day.py:971-1170
Behaviors behind the backdoor verdict
Observables
- Network Probe
- Payload withheldThe scanner issues unauthenticated GET requests to fingerprint cpsrvd and assess the proxy chain. This is documented as passive scanning and does not constitute a backdoor.
cpanel-0day.py:197-245cpanel-0day.py:248-299 - Ssh Command
- Payload withheldIn SSH mode, the scanner executes a single passive curl from the target to verify the proxy hop. This is a diagnostic step, not a backdoor or payload delivery.
cpanel-0day.py:754-788 - Ssh Command
- Payload withheldThe scanner checks Apache access logs for the marker left by the proxy-hop verification curl. This is part of the diagnostic chain and does not exfiltrate data or establish persistence.
cpanel-0day.py:770-776
What the analysis did not establish
- Evidence is limited to the two text files (README.md and cpanel-0day.py) provided in the packet. No binary files, network captures, or execution logs are included.
- The artifact's self-description as a scanner is taken at face value; no dynamic analysis was performed to confirm it does not contain hidden exploit logic.
- Only the two text files (README.md and cpanel-0day.py) were provided for review. No binary files were present in the evidence packet.
- The review is limited to static analysis of the supplied source code; runtime behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubSachinart/CVE-2025-54322
Repository PoCStars: 8Created 2025-12-26ScannerCVE-2025-543222 files
Analysis
Technical assessment
A multi-threaded Python scanner that checks for CVE-2025-54322 by sending a crafted HTTP request to a target and inspecting the response for indicators of command execution. It does not establish an interactive shell or deliver a payload beyond a detection probe.
Backdoor review
No backdoor observed in reviewed code
The repository contains a README and a Python scanner for CVE-2025-54322. The scanner sends crafted HTTP requests to test for the vulnerability and checks responses for command output. No concealed executable behavior, unrelated payload, credential theft, persistence, or operator-directed harm was observed. The code performs only the advertised vulnerability scanning.
Classification basis and observed behavior
Classification basis
The code's primary purpose is to detect the presence of CVE-2025-54322 by sending a probe and analyzing the response for signs of successful command execution. It does not provide an interactive shell, exfiltrate data, or perform any post-exploitation actions. The README explicitly describes it as a 'vulnerability scanner' and 'RCE Vulnerability Checker'.
README.md:1README.md:7scanner.py:115-224Requirements
- Target URL of a potentially vulnerable XSpeeder SXZOS device
scanner.py:226-231 - Network connectivity to the target
scanner.py:100-110
Observed behavior
- Sends an HTTP GET request to /?title=ABC&oIp=XXX&chkid=<base64_payload> with a calculated nonce header and spoofed User-Agent
scanner.py:100-110scanner.py:71-77scanner.py:119-126 - Inspects the HTTP response body for the output of the 'id' command (uid/gid pattern) or other code execution indicators
scanner.py:156-196 - Logs vulnerable targets to console and writes them to a local file (payload withheld)
scanner.py:245-256scanner.py:28-35
Behaviors behind the backdoor verdict
Observables
- Exploit Payload
- Payload withheldThe scanner builds a payload that executes the 'id' command on the target to confirm RCE. This matches the described CVE exploitation technique.
scanner.py:75 - Network Request
- Payload withheldThe scanner sends the exploit payload to the target's root path with specific query parameters, consistent with the CVE description.
scanner.py:103 - Output File
- Payload withheldThe scanner writes confirmed vulnerable hosts and command output to a local file for reporting.
scanner.py:28-35
What the analysis did not establish
- Evidence consists of two complete text files (README.md and scanner.py) from a repository snapshot. No binary files or additional source files were present. The analysis is based solely on static review of the provided source code; the code was not executed.
- Only the two text files (README.md and scanner.py) were provided; no other repository files (e.g., requirements.txt, LICENSE) were included, but their absence does not affect the backdoor assessment.
- The analysis is static and does not execute the code; dynamic behavior or network interactions are not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubSachinart/CVE-2025-61882
Repository PoCStars: 9Created 2025-10-06ExploitCVE-2025-618823 files
Analysis
Technical assessment
The artifact is a multi-threaded bulk exploitation tool for CVE-2025-61882 in Oracle E-Business Suite. It actively exploits an HTTP request smuggling vulnerability to achieve unauthenticated remote code execution by delivering a malicious XSL payload that executes a system command (`id`) and exfiltrates the output via a callback.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a Python scanner script for CVE-2025-61882. The script performs the advertised exploit behavior: it sends HTTP requests to targets, serves a malicious XSL payload, and listens for callbacks containing the output of the 'id' command. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or operator-directed harm was observed. The code is straightforward and its behavior aligns with the described vulnerability scanner.
Classification basis and observed behavior
Classification basis
The code actively exploits the vulnerability by sending a crafted HTTP request smuggling payload to trigger a server-side request to an attacker-controlled server, which then serves a malicious XSL payload that executes an arbitrary system command ('id') on the target. This goes beyond detection or validation; it achieves remote code execution and exfiltrates the result.
cve-2025-61882.py:30cve-2025-61882.py:104-113cve-2025-61882.py:135-141Requirements
- Requires a target Oracle E-Business Suite instance vulnerable to CVE-2025-61882.
README.md:4 - Requires an attacker-controlled server (VPS) to receive callbacks from the target.
README.md:40
Observed behavior
- Fetches a CSRF token from the target's /OA_HTML/runforms.jsp and /OA_HTML/JavaScriptServlet endpoints.
cve-2025-61882.py:118-125 - Constructs an HTTP request smuggling payload that injects a request to an attacker-controlled server.
cve-2025-61882.py:104-113 - Sends the smuggling payload to the target's /OA_HTML/configurator/UiServlet endpoint.
cve-2025-61882.py:135-141 - Starts an HTTP server on a random port to serve a malicious XSL stylesheet that executes a system command via Java reflection.
cve-2025-61882.py:24-33 - The XSL payload instructs the target to execute 'curl' to send the base64-encoded output of the 'id' command back to the attacker's server.
cve-2025-61882.py:30 - Receives the callback, decodes the base64 data, and validates successful exploitation by matching a regex pattern for the 'id' command output.
cve-2025-61882.py:55-77 - Logs the vulnerable target's IP and command output to 'vuln-output.txt'.
cve-2025-61882.py:75-77
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the normal, advertised behavior of a proof-of-concept exploit for the stated CVE.
cve-2025-61882.py:30cve-2025-61882.py:55-77cve-2025-61882.py:101-116 - Network Listener
- Payload withheldThis is required for the exploit's callback mechanism and is consistent with the documented functionality.
cve-2025-61882.py:145-150 - File Write
- Payload withheldThis is a standard logging feature for a scanner tool and does not indicate backdoor behavior.
cve-2025-61882.py:76-77cve-2025-61882.py:176-180
What the analysis did not establish
- One file (LICENSE) is omitted from the packet; its content is not provided.
- The analysis is based solely on static code review; the code was not executed, and its operational reliability is not verified.
- One file (LICENSE) was present in the repository but not included in the text evidence; it is a standard metadata file and unlikely to contain executable code.
- The review is limited to the supplied text evidence and does not include dynamic analysis or inspection of the omitted file.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.