BridgerAlderson
Source-scoped identity with 8 associated PoCs and 8 linked vulnerabilities.
Exploit catalog results
Showing 8 PoCs on this page
GitHubBridgerAlderson/CVE-2026-58424
Repository PoCStars: 2Created 2026-08-02ExploitCVE-2026-584242 files
Analysis
Technical assessment
A Python script that exploits CVE-2026-58424, a Gitea Actions approval gate bypass, by injecting a malicious workflow into a forked repository and triggering it via a pull request review comment to achieve remote code execution on the runner.
Backdoor review
No backdoor observed in reviewed code
The PoC implements a documented CVE-2026-58424 exploit against Gitea. It uses the Gitea API to fork a repo, inject a workflow, open a PR, and trigger a review event to bypass the approval gate, resulting in a reverse shell. All behavior is consistent with the stated vulnerability and no concealed backdoor, credential exfiltration, persistence, or unrelated payload was observed.
Classification basis and observed behavior
Classification basis
The artifact is a fully functional Python script that automates the exploitation of CVE-2026-58424. It performs all steps required to achieve remote code execution: authentication, forking, workflow injection, pull request creation, and triggering the bypass via a review comment. The README explicitly describes it as a PoC and provides usage instructions for exploitation.
CVE-2026-58424.py:1-4README.md:45Requirements
- Requires a Gitea account with fork permission and an API token, Kerberos ticket, or session cookie.
CVE-2026-58424.py:17-29 - Target repository must have Gitea Actions enabled.
CVE-2026-58424.py:364-367 - An act_runner must be online and registered for the target repository.
README.md:40 - Attacker host must be reachable from the runner to receive the reverse shell.
README.md:41
Observed behavior
- Authenticates to the Gitea API using a token, Kerberos ticket, or session cookie.
CVE-2026-58424.py:283-328 - Forks the target repository into the attacker's namespace.
CVE-2026-58424.py:486-494 - Enables Actions on the forked repository.
CVE-2026-58424.py:496-504 - Injects a malicious workflow YAML file into the fork that includes a reverse shell payload and triggers on pull_request_review and other unapproved events.
CVE-2026-58424.py:545-618 - Opens a pull request from the fork to the target repository.
CVE-2026-58424.py:622-693 - Triggers the bypass by posting a review comment on the pull request, which fires a pull_request_review event that dispatches the workflow job without approval.
CVE-2026-58424.py:697-716 - The runner executes the payload, establishing a reverse shell to the attacker's listener.
CVE-2026-58424.py:887-905
Behaviors behind the backdoor verdict
Observables
- Reverse Shell Payload
- Payload withheldStandard reverse shell payload delivered via the injected workflow; consistent with the stated exploit goal.
CVE-2026-58424.py:129 - Exploit Trigger
- Payload withheldThe core bypass mechanism matches the CVE description: posting a review comment triggers pull_request_review event without approval check.
CVE-2026-58424.py:697-716
What the analysis did not establish
- Evidence is limited to the supplied text files; no binary or opaque content was inspected.
- The artifact's behavior is inferred from static analysis of the source code; it was not executed.
- The analysis assumes the code functions as described; no verification of its effectiveness or safety was performed.
- Only the two text files (CVE-2026-58424.py and README.md) were reviewed; no binary files were present in the evidence packet.
- The review does not assess the safety or correctness of the exploit code, only the presence of backdoor behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubBridgerAlderson/CVE-2025-69212-PoC
Repository PoCStars: 3Created 2026-06-30ExploitCVE-2025-692123 files
Analysis
Technical assessment
A Python exploit for CVE-2025-69212, an OS command injection vulnerability in OpenSTAManager <= 2.9.8. The script authenticates to the target, discovers the vulnerable plugin, and uploads a crafted ZIP file containing a .p7m file with a malicious filename to achieve remote code execution. It supports vulnerability checking, webshell deployment, interactive shell, reverse shell, and blind command execution.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python exploit script and a README for CVE-2025-69212, an OS command injection vulnerability in OpenSTAManager. The exploit automates authenticated exploitation of the described vulnerability (check, webshell deployment, reverse shell, blind command execution, interactive shell). All code behavior is consistent with the stated purpose of demonstrating and exploiting the CVE. No concealed, deceptive, or unrelated harmful behavior was observed.
Classification basis and observed behavior
Classification basis
The artifact is a fully functional Python script that actively exploits CVE-2025-69212 to achieve remote code execution. It crafts and uploads a malicious payload to trigger the vulnerability, and includes multiple post-exploitation features such as webshell deployment, reverse shell, and interactive command execution. This goes beyond mere detection or scanning.
exploit.py:1-3exploit.py:276-285exploit.py:347-542README.md:42-55Requirements
- Valid credentials (username/password) or a valid PHPSESSID cookie for an OpenSTAManager instance.
exploit.py:84-86exploit.py:602-603 - The target must have the importFE_ZIP plugin installed and accessible.
README.md:39-40exploit.py:217-274
Observed behavior
- Authenticates to the target OpenSTAManager instance using provided credentials or session cookie.
exploit.py:114-174 - Discovers the module and plugin IDs for the importFE_ZIP plugin by scanning the application's pages.
exploit.py:217-274 - Crafts a ZIP archive containing a .p7m file with a malicious filename that injects OS commands via the exec() call in XML::decodeP7M().
exploit.py:276-285README.md:185-196 - Uploads the malicious ZIP file to the discovered plugin endpoint to trigger command execution.
exploit.py:288-323 - Provides multiple exploitation modes: vulnerability check (--check), webshell deployment (--webshell), interactive shell (--rce), reverse shell (--reverse-shell), and blind command execution (--cmd).
exploit.py:347-375exploit.py:377-408exploit.py:410-461exploit.py:463-490exploit.py:492-542
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldAll actions are directed at the target specified by the user and are consistent with the documented vulnerability.
exploit.py:82-543 - Payload Encoding
- Payload withheldThis is a documented technique to bypass the ZipArchive filename restriction, not an attempt to conceal malicious behavior.
exploit.py:276-278README.md:199-207 - Network Communication
- Payload withheldNo unexpected external network connections are made; all communication is directed at the target or proxy as configured by the user.
exploit.py:98-105
What the analysis did not establish
- One file (LICENSE) was omitted from the text evidence due to being unclassified, but it is not expected to contain exploit logic.
- The evidence coverage is complete for the two selected text files (README.md and exploit.py), which constitute the entire functional artifact.
- One unclassified file (1068 bytes) was present in the repository but not analyzed; its content is unknown.
- The review is limited to the supplied text evidence and does not include dynamic analysis or execution of the exploit.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubBridgerAlderson/CVE-2026-24418
Repository PoCStars: 2Created 2026-06-28ExploitCVE-2026-244183 files
Analysis
Technical assessment
A Python script (exploit.py) that exploits CVE-2026-24418, an error-based SQL injection vulnerability in OpenSTAManager <= 2.9.8. It authenticates to the target, injects SQL payloads via the id_records[] parameter in the Scadenzario module, and extracts data using EXTRACTVALUE error messages. The tool includes modules for database enumeration, credential dumping, file reading, webshell upload, and interactive command execution.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Python exploit script (exploit.py) and a README.md for CVE-2026-24418, an error-based SQL injection vulnerability in OpenSTAManager. The exploit performs standard SQL injection operations: database enumeration, credential dumping, file reading via LOAD_FILE(), and webshell upload/RCE via INTO DUMPFILE. All actions are user-initiated through command-line arguments and target a specified remote host. No concealed, unrelated, or operator-directed harmful behavior (e.g., credential theft from the local machine, persistence, unrelated payloads) was observed. The code is straightforward and its functionality aligns with the documented CVE exploitation.
Classification basis and observed behavior
Classification basis
The artifact is a fully functional Python script that actively exploits the SQL injection vulnerability to extract data, read files, and deploy a webshell for remote code execution. It is not a scanner, as it does not merely detect the vulnerability; it performs exploitation actions.
exploit.py:1-982README.md:29-47Requirements
- Valid user credentials or a session cookie for the target OpenSTAManager instance.
exploit.py:124-173 - The target must be running OpenSTAManager version <= 2.9.8 with the vulnerable Scadenzario module (id_module=18) accessible.
README.md:12-14
Observed behavior
- Authenticates to the target application using provided credentials or a PHPSESSID cookie.
exploit.py:124-173 - Sends a crafted POST request to /actions.php?id_module=18 with a malicious id_records[] parameter containing an EXTRACTVALUE-based SQL injection payload.
exploit.py:193-215 - Extracts data from the database by parsing XPATH syntax error messages in the HTTP response.
exploit.py:210-215 - Performs database reconnaissance, including retrieving version, current user, hostname, and file paths.
exploit.py:265-291 - Dumps user credentials from the zz_users table and exports them in hashcat and John the Ripper formats.
exploit.py:544-617 - Reads arbitrary files from the server's filesystem using the LOAD_FILE() MySQL function.
exploit.py:331-353 - Attempts to upload a PHP webshell to the webroot via an INTO DUMPFILE SQL statement and provides an interactive command execution interface.
exploit.py:398-542
Behaviors behind the backdoor verdict
Observables
- Exploit Capability
- Payload withheldThe script sends crafted id_records[] payloads to /actions.php?id_module=18 to extract data via EXTRACTVALUE XPATH errors.
exploit.py:197-205 - Exploit Capability
- Payload withheldThe script provides options (--info, --users, --file-read, --webshell, --rce) to perform various post-exploitation activities on the target server.
exploit.py:840-872 - Network Behavior
- Payload withheldThe script only communicates with the target provided via the -t/--target argument; no external or hardcoded C2 communication is present.
exploit.py:100exploit.py:197
What the analysis did not establish
- The evidence includes a complete README.md and exploit.py. A third file (likely a license or similar) was omitted from the text content, but this does not affect the classification of the primary artifact.
- One file (metadata only) was omitted from the evidence packet; its content was not reviewed.
- The review is limited to the supplied text evidence and does not include dynamic analysis or execution.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubBridgerAlderson/CVE-2025-81110-PoC
Repository PoCStars: 4Created 2026-04-11ExploitCVE-2025-811103 files
Analysis
Technical assessment
A Python script that exploits CVE-2024-39930 in Gogs by creating a symlink to a Git hook via the API, overwriting the hook with a malicious payload, and triggering it to achieve RCE (reverse shell or SUID binary).
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python exploit script (CVE-2025-81110.py) and its README.md. The script implements a documented proof-of-concept for CVE-2025-81110, targeting a Gogs server vulnerability. It uses provided credentials to create a repository, push a symlink, overwrite a server-side Git hook via the API, and trigger execution. The payloads are a SUID bash copy or a reverse shell, both standard post-exploitation actions consistent with the stated vulnerability. No concealed, deceptive, or unrelated harmful behavior was observed in the reviewed text.
Classification basis and observed behavior
Classification basis
The Python script performs a multi-step attack that authenticates, creates a repository, pushes a symlink, overwrites a server-side Git hook with attacker-controlled code, and triggers its execution. This is active exploitation, not just detection or scanning.
CVE-2025-81110.py:38-66README.md:4Requirements
- Valid Gogs credentials (username and password) for an authenticated user.
CVE-2025-81110.py:168-169 - Target Gogs instance URL.
CVE-2025-81110.py:167 - Python 3.x, requests library, and git command-line tool on the attacker machine.
README.md:13-15
Observed behavior
- Authenticates to the Gogs API and creates an API token.
CVE-2025-81110.py:67-77 - Creates an empty repository with auto_init disabled.
CVE-2025-81110.py:79-97 - Creates a local symlink pointing to the server-side pre-receive Git hook and pushes it to the repository.
CVE-2025-81110.py:99-122 - Overwrites the symlink content via the API, which follows the link and writes a malicious script (reverse shell or SUID bash copy) into the pre-receive hook.
CVE-2025-81110.py:135-148 - Triggers the hook by performing a final Git push, causing the server to execute the malicious script.
CVE-2025-81110.py:150-163
Behaviors behind the backdoor verdict
Observables
- Exploit Payload
- Payload withheldThese are the intended post-exploitation actions for the CVE, not a backdoor hidden within the PoC itself.
CVE-2025-81110.py:138-140 - Target Behavior
- Payload withheldThe script's behavior is directed at the specified target, not the operator's machine.
CVE-2025-81110.py:13-19CVE-2025-81110.py:166-173
What the analysis did not establish
- One file (total 3) omitted from text content; metadata indicates it is a non-text file (likely binary).
- CVE-2025-81110 record was absent from the acquired CVEList V5 dataset.
- The artifact references CVE-2024-39930 in its banner, not CVE-2025-81110.
- One file (unclassified, 1068 bytes) was omitted from the text evidence; its content is unknown.
- The review is based solely on static analysis of the provided text; the script was not executed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubBridgerAlderson/CVE-2024-51482
Repository PoCStars: 8Created 2026-03-08ExploitCVE-2024-514822 files
Analysis
Technical assessment
Python script that exploits CVE-2024-51482, a blind SQL injection in ZoneMinder, by authenticating, confirming vulnerability via time-based SLEEP, and extracting database schema and data using binary search.
Backdoor review
No backdoor observed in reviewed code
The PoC is a straightforward Python script that exploits CVE-2024-51482, a blind SQL injection in ZoneMinder, by sending time-based payloads to extract database contents. No backdoor, deceptive payload, or concealed operator-directed harm is present. The script only interacts with the user-supplied target and performs no unrelated network activity, persistence, or credential exfiltration.
Classification basis and observed behavior
Classification basis
The Python script actively exploits CVE-2024-51482 by sending crafted HTTP requests with SQL SLEEP payloads to extract database contents, going beyond detection to perform data exfiltration.
CVE-2024-51482.py:90-109CVE-2024-51482.py:138CVE-2024-51482.py:263-288Requirements
- Valid ZoneMinder credentials (default admin/admin)
CVE-2024-51482.py:312-313 - Network access to ZoneMinder web interface
README.md:96 - Target running ZoneMinder 1.37.0 - 1.37.64
README.md:30
Observed behavior
- Authenticates to ZoneMinder using supplied credentials to obtain a session cookie
CVE-2024-51482.py:48-88 - Measures baseline HTTP response time by sending normal requests
CVE-2024-51482.py:111-130 - Confirms vulnerability by injecting a SLEEP payload and checking for delayed response
CVE-2024-51482.py:132-151 - Extracts database names, tables, columns, and row data using time-based blind SQL injection with binary search over ASCII range
CVE-2024-51482.py:153-204CVE-2024-51482.py:206-288 - Dumps ZoneMinder Users table including usernames and password hashes
CVE-2024-51482.py:290-302
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe script constructs SQL payloads with SLEEP() to infer data character-by-character via binary search. This is the expected exploit behavior for the stated CVE.
CVE-2024-51482.py:138-139CVE-2024-51482.py:159-162 - Target Interaction
- Payload withheldThe base URL is constructed from the --ip argument, and no other hosts are contacted. This confines the exploit to the intended target.
CVE-2024-51482.py:33CVE-2024-51482.py:92 - Credential Usage
- Payload withheldCredentials are sent exclusively to the target's login endpoint and are not exfiltrated elsewhere.
CVE-2024-51482.py:54-60
What the analysis did not establish
- Evidence does not include execution results; classification is based solely on static code analysis of the provided text files.
- The artifact's complete_artifact_coverage is false, indicating the repository snapshot may contain additional files not included in this packet.
- Only the two text files (CVE-2024-51482.py and README.md) were provided; no other files exist in the repository snapshot.
- The review does not assess the safety of the target system or the legality of using the exploit.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubBridgerAlderson/CVE-2025-9074-PoC
Repository PoCStars: 50Created 2025-12-06ExploitCVE-2025-90742 files
Analysis
Technical assessment
A Bash script that exploits CVE-2025-9074 by connecting to an unauthenticated Docker Engine API, creating a privileged container with host root filesystem mounted, and executing arbitrary commands on the host.
Backdoor review
No backdoor observed in reviewed code
The PoC is a straightforward Bash script that exploits CVE-2025-9074 by using the Docker Engine API to create a container with a host bind mount and execute a user-supplied command. No backdoor, concealed payload, or operator-directed harm was observed. The script performs only the advertised exploit behavior and cleanup.
Classification basis and observed behavior
Classification basis
The script actively exploits the vulnerability by creating a privileged container with host filesystem mounted and executing arbitrary commands, which goes beyond detection or scanning. The README explicitly describes it as 'Proof of Concept exploit code' and the script header states 'Docker API Unauthenticated RCE PoC'.
cve-2025-9074.sh:3-4readme.md:3readme.md:6Requirements
- Target must have Docker Engine API exposed on TCP port 2375 without authentication.
cve-2025-9074.sh:27-28 - Attacker must have network access to the target IP and port.
cve-2025-9074.sh:25-28
Observed behavior
- Connects to Docker API at http://<TARGET_IP>:2375 and retrieves engine info.
cve-2025-9074.sh:32 - Detects host OS type from API response to select mount path (Linux: /:/host_root, Windows: /mnt/host/c:/host_root).
cve-2025-9074.sh:39-52 - Enumerates available Docker images on the target.
cve-2025-9074.sh:56 - Creates a new container with host root filesystem bind-mounted inside it.
cve-2025-9074.sh:71-81 - Starts the container and executes an attacker-supplied shell command inside it, effectively running the command on the host with container privileges.
cve-2025-9074.sh:94-112 - Forcefully removes the container after command execution to clean up.
cve-2025-9074.sh:117
Behaviors behind the backdoor verdict
Observables
- Exploit Mechanism
- Payload withheldThe script creates a container with a host root bind mount and executes a user-supplied command inside it, consistent with the described CVE-2025-9074 exploit.
cve-2025-9074.sh:71-77cve-2025-9074.sh:99-112 - Target Interaction
- Payload withheldAll network interactions are directed to the target IP and port provided as command-line arguments, with no hardcoded external addresses.
cve-2025-9074.sh:25-28
What the analysis did not establish
- Evidence is limited to static source code analysis; the script was not executed.
- The README references an image (line 22) that is not included in the text evidence, so its content cannot be verified.
- Only the two text files (cve-2025-9074.sh and readme.md) were reviewed; no binary or other files were present in the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.