uvettrivel007
Source-scoped identity with 1 associated PoC and 1 linked vulnerability.
Exploit catalog results
Showing 1 PoC on this page
ExploitDBFacturaScripts 2025.43 - XSS
ExploitDB exploitPublished 2026-04-29ExploitCVE-2025-692101 file
Analysis
Technical assessment
The artifact provides a complete stored XSS exploit against FacturaScripts 2025.43. It includes a crafted XML payload with multiple XSS vectors (namespace-wrapped script tags and CDATA-embedded script) and step-by-step instructions for uploading the file as an authenticated user, then triggering execution when an administrator accesses the file.
Backdoor review
No backdoor observed in reviewed code
The supplied text is a standard proof-of-concept exploit description for CVE-2025-69210, a stored XSS vulnerability in FacturaScripts. It contains only documentation, reproduction steps, and example payloads that demonstrate the claimed XSS behavior (alert and redirect). No concealed executable behavior, persistence, credential theft, or unrelated remote access is present. The payloads are inline and consistent with the disclosed vulnerability.
Classification basis and observed behavior
Classification basis
The artifact contains executable exploit code: a complete XML payload with multiple XSS vectors (lines 53-91) and a full HTTP request template (lines 45-93) that, when sent by an authenticated attacker, stores the payload. The instructions describe triggering execution by accessing the uploaded file (lines 97-100), which constitutes exploitation, not mere detection.
exploits/multiple/webapps/52517.txt:53-91exploits/multiple/webapps/52517.txt:45-93exploits/multiple/webapps/52517.txt:97-100Requirements
- Authenticated access as a normal user to FacturaScripts instance
exploits/multiple/webapps/52517.txt:28 - Ability to upload files to a product (or intercept and modify upload request)
exploits/multiple/webapps/52517.txt:40-42 - Victim (e.g., administrator) must access the uploaded XML file via the generated URL
exploits/multiple/webapps/52517.txt:97-100
Observed behavior
- Uploads a crafted XML file containing multiple XSS payloads (namespace-wrapped script tags and CDATA-embedded script) via a multipart POST request
exploits/multiple/webapps/52517.txt:45-93 - When the uploaded file is accessed, the browser executes the embedded JavaScript, displaying an alert('XSS') and optionally redirecting to an attacker-controlled domain
exploits/multiple/webapps/52517.txt:56-68exploits/multiple/webapps/52517.txt:74-79exploits/multiple/webapps/52517.txt:103-105
Behaviors behind the backdoor verdict
Observables
- Url
- Payload withheldExample attacker-controlled domain used in XSS payload redirect demonstrations.
exploits/multiple/webapps/52517.txt:60exploits/multiple/webapps/52517.txt:67exploits/multiple/webapps/52517.txt:77 - Url
- Payload withheldExample benign URL used in the XML payload's info section.
exploits/multiple/webapps/52517.txt:87
What the analysis did not establish
- Evidence is limited to the single text file from ExploitDB; no external tools, libraries, or referenced resources were analyzed.
- The artifact includes an HTTP request template with placeholder cookies; actual exploitation requires valid authenticated session cookies.
- The artifact does not include a fully automated script; the exploit steps require manual interaction or adaptation.
- Only the readable text of the exploit file was reviewed; no binary files or external resources were inspected.
- The review does not verify the exploit works or assess the safety of the target application.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.