BimBoxH4
Source-scoped identity with 1 associated PoC and 3 linked vulnerabilities.
Exploit catalog results
Showing 1 PoC on this page
GitHubBimBoxH4/CVE-2025-66039_CVE-2025-61675_CVE-2025-61678_reePBX
Repository PoCStars: 1Created 2025-12-14ExploitCVE-2025-61675CVE-2025-61678CVE-2025-660393 files
Analysis
Technical assessment
A Python-based tool that performs authenticated SQL injection exploitation (CVE-2025-61675) by inserting a new administrative user into the database, and attempts authenticated arbitrary file upload (CVE-2025-61678) leading to remote code execution via a PHP webshell. It also includes an authentication bypass check (CVE-2025-66039) to obtain a session cookie.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python-based vulnerability scanner for FreePBX systems targeting CVE-2025-66039, CVE-2025-61675, and CVE-2025-61678. The code performs authentication bypass via PHPSESSID extraction, file upload testing, and SQL injection detection/exploitation. All behavior is consistent with the stated purpose of a security assessment tool. No concealed backdoor, unrelated remote access, persistence mechanisms, or deceptive payloads were observed.
Classification basis and observed behavior
Classification basis
The artifact's primary operation is to exploit vulnerabilities, not just detect them. The 'exploit_sql_injection' function executes an INSERT statement to add a new user to the database, and the 'upload_exploit' function uploads a PHP webshell to achieve remote code execution. The README and code comments refer to the tool as an 'Exploitation Tool'.
exploit.py:388-465exploit.py:160-227README.md:34Requirements
- Target must be running a vulnerable version of FreePBX with the Endpoint Manager module.
README.md:23-25 - For SQL injection and file upload, authentication is required. The tool attempts to bypass authentication using a hardcoded Authorization header.
exploit.py:115-119
Observed behavior
- Sends an HTTP GET request with a hardcoded Basic Authorization header to /admin/config.php to extract a PHPSESSID cookie, exploiting CVE-2025-66039.
exploit.py:109-133 - Constructs and sends a multipart/form-data POST request to /admin/ajax.php to upload a PHP file (text1.php) containing a simple echo statement, using a path traversal in the 'fwbrand' parameter to place it in the web root.
exploit.py:160-227 - Verifies the uploaded PHP file by sending a GET request to the target URL and checking for the expected random string in the response.
exploit.py:256-284 - Sends POST requests with SQL injection payloads to multiple endpoints (basestation, firmware, basefile, customExt) to detect SQL injection vulnerabilities.
exploit.py:354-386 - Exploits a confirmed SQL injection vulnerability by sending a crafted POST request to the customExt endpoint that executes an INSERT statement to add a new administrative user ('textuser') to the 'ampusers' table.
exploit.py:388-465
Behaviors behind the backdoor verdict
Observables
- Credential Injection
- Payload withheldHardcoded credentials injected via SQL exploit for testing purposes, consistent with PoC demonstration.
exploit.py:403-404 - File Upload Payload
- Payload withheldUploads a simple PHP file to verify file upload vulnerability; no malicious webshell or backdoor code.
exploit.py:168-226 - Authentication Bypass
- Payload withheldUses hardcoded Authorization header to bypass webserver authentication, matching CVE-2025-66039 description.
exploit.py:115-118
What the analysis did not establish
- Evidence is limited to the source code and README; no runtime output or network captures are provided to confirm the exploit's effectiveness.
- The analysis scope indicates 'complete_artifact_coverage: false' for the packet, meaning not all files from the repository may be present, though all selected text files are complete.
- No binary files were present in the artifact.
- The review is limited to the supplied text files; no runtime behavior or network traffic was observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.