khaifunglee

GitHub · Repository owner · Source ID 174327222
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

khaifunglee/reproducing-CVE-2025-1489

Repository PoC0Created 2025-12-11ScannerCVE-2025-14896 files

896.1 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact sets up a Docker environment to reproduce CVE-2025-1489, a stored XSS vulnerability in the WP-Appbox WordPress plugin. It includes an attacker-controlled HTTP server (server.py) designed to log inbound GET requests, which serves as a detection mechanism to confirm the vulnerability by observing callbacks triggered by the injected payload. The README describes the steps to create a malicious shortcode, but the actual exploit payload is not provided in the supplied text files.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files (README.md and attacker/server.py) describe a legitimate proof-of-concept for CVE-2025-1489, a stored XSS vulnerability in the WP-Appbox WordPress plugin. The server.py script is a simple HTTP server designed to log incoming requests, which is standard behavior for demonstrating an out-of-band XSS callback. No concealed, deceptive, or operator-directed harmful behavior is present in the supplied text.

ClassificationScanner
Model confidence90%
AuthenticationRequired
LanguagesPythonMarkdown
Target softwareWordPressWP-Appbox plugin (<= 4.5.4)
Attack typesStored Cross-Site Scripting (XSS)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is classified as a scanner because its primary operation, as evidenced by the provided code, is to set up a detection environment. The attacker server (server.py) is designed to log HTTP requests, which would serve as a callback to confirm the presence of the vulnerability. The README describes the vulnerability and the steps to trigger it, but the actual exploit payload is not present in the supplied text files. The code does not autonomously exploit the vulnerability; it provides a mechanism to observe whether a manually crafted payload succeeds.

attacker/server.py:1-41README.md:1-55

Requirements

  • An authenticated WordPress user with at least Author role privileges is required to create a post containing the malicious shortcode.README.md:53-55
  • The WP-Appbox plugin version 4.5.4 must be installed and activated on the target WordPress instance.README.md:33README.md:52

Observed behavior

  • The attacker server (server.py) listens on port 8000 and logs the client IP, request line, Referer, and User-Agent for every incoming GET or HEAD request to a log file.attacker/server.py:18-28
  • The README instructs the user to craft a malicious shortcode payload to trigger the XSS, but the specific payload is not included in the provided text files.README.md:55
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Http Server
Payload withheldThe server is configured to log all incoming GET and HEAD requests, including Referer and User-Agent headers, to a file. This is consistent with capturing XSS callbacks for a proof-of-concept.attacker/server.py:18-28attacker/server.py:38-41
File Logging
Payload withheldLogged data is written to a local file, which is standard for recording proof-of-concept results. No exfiltration or persistence mechanism is implemented.attacker/server.py:6attacker/server.py:12-14
Review boundaries

What the analysis did not establish

  • The full_report.pdf binary file is flagged as uninspected and may contain the actual exploit payload or further details.
  • The text file attacker/test.py is listed as unavailable as text and its content is unknown.
  • The README.md file ends abruptly at line 55, and the subsequent steps for crafting the malicious payload are not included in the provided text.
  • The file full_report.pdf (912023 bytes) is a binary document and was not analyzed. Its content is unknown.
  • The file attacker/test.py is listed in the inventory but its content was not supplied and is unavailable as text.
  • Three additional text files are present in the repository but were not included in the evidence packet.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.