flame-11
Source-scoped identity with 6 associated PoCs and 6 linked vulnerabilities.
Exploit catalog results
Showing 6 PoCs on this page
GitHubflame-11/CVE-2025-54068-livewire
Repository PoCStars: 1Created 2026-01-08ExploitCVE-2025-5406810 files
Analysis
Technical assessment
A Python script that performs a two-stage remote code execution attack against a Livewire 3.6.3 application by sending crafted JSON payloads to the Livewire update endpoint, using a PHP deserialization chain to execute a system command and confirming success via an in-band marker.
Backdoor review
No backdoor observed in reviewed code
The PoC demonstrates a legitimate exploit for CVE-2025-54068 against a vulnerable Livewire instance. It uses a safe in-band marker (echo) as proof of RCE and contains no concealed backdoor, credential theft, persistence, or unrelated payload.
Classification basis and observed behavior
Classification basis
The script actively sends crafted payloads to execute a system command on the target server and verifies the output, which constitutes exploitation rather than mere detection or scanning.
scripts/poc.py:105scripts/poc.py:178-179Requirements
- A Livewire component must be mounted and configured to allow property updates that can be cast to an array.
README.md:5 - The target must be running Livewire v3 up to 3.6.3.
README.md:3
Observed behavior
- Fetches the target page and extracts CSRF token, update URI, and wire:snapshot.
scripts/poc.py:57-75 - Sends a first JSON payload to cast a component property to an array, obtaining a new signed snapshot.
scripts/poc.py:88-101 - Sends a second JSON payload containing a PHP deserialization gadget chain that executes 'payload withheld' via the system function.
scripts/poc.py:103-177 - Checks the response for the marker string to confirm successful command execution.
scripts/poc.py:178-183
Behaviors behind the backdoor verdict
Observables
- Command Execution
- Payload withheldThe PoC executes a safe echo command as an in-band proof of RCE, consistent with the stated CVE exploit.
scripts/poc.py:105 - Exploit Chain
- Payload withheldThe PoC constructs a two-stage exploit using a known deserialization chain to achieve RCE, matching the CVE description.
scripts/poc.py:88-175
What the analysis did not establish
- Only 3 of 10 repository files were provided as readable text; the remaining 7 files (including PHP component and view files) were omitted, limiting full context of the vulnerable component setup.
- The evidence does not include the execution output of the script, so the exploit's success is based solely on the code logic.
- 7 text files and 0 binary files were omitted from the evidence packet; their content was not reviewed.
- The review is based solely on the supplied text evidence and does not verify the safety of the target application or the exploit's reliability.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubflame-11/CVE-2018-15133-laravel-framework
Repository PoCStars: 0Created 2025-12-29ScannerCVE-2018-151336 files
Analysis
Technical assessment
The artifact is a Docker-based lab environment for CVE-2018-15133, designed to be used with an external scanner (e.g., Nuclei) to validate the vulnerability. It does not contain exploit code itself.
Backdoor review
No backdoor observed in reviewed code
The repository is a Docker-based lab for CVE-2018-15133. All reviewed text files (Dockerfile, README.md, routes/web.php) describe or implement a vulnerable Laravel application setup and a benign POST route. No concealed executable behavior, credential theft, persistence, or unrelated payload is present in the supplied evidence.
Classification basis and observed behavior
Classification basis
The artifact's primary purpose is to provide a vulnerable target for validation. The README explicitly states it is a 'Vulnerable Lab' and instructs users to 'Use any PoC that crafts a Laravel-encrypted X-XSRF-TOKEN' or a 'Nuclei template for CVE-2018-15133' to validate the vulnerability. The provided code (Dockerfile, routes) only sets up the environment and does not contain any exploit or scanning logic itself. This makes it a scanner support component, classified as a scanner.
README.md:1README.md:23README.md:28-33Requirements
- The attacker must know the application's APP_KEY.
README.md:18-19
Observed behavior
- Sets up a vulnerable Laravel 5.6.29 application with a known APP_KEY.
Dockerfile:3Dockerfile:41README.md:18-19 - Exposes a POST route at '/poc' to trigger CSRF token parsing.
routes/web.php:11-13 - Instructs users to run an external Nuclei scanner template against the lab to validate the vulnerability.
README.md:23README.md:28-33
Behaviors behind the backdoor verdict
Observables
- Fixed App Key
- Payload withheldThe README discloses a known APP_KEY used by the lab, which is required for the CVE-2018-15133 exploit scenario. This is a deliberate lab configuration, not a backdoor.
README.md:19 - Vulnerable Application Setup
- Payload withheldThe Dockerfile installs a vulnerable Laravel version and the routes file defines a POST route that triggers CSRF handling, consistent with the CVE-2018-15133 description. This is the intended lab behavior.
Dockerfile:41routes/web.php:11-13
What the analysis did not establish
- The evidence packet reports complete_artifact_coverage as false, indicating not all files from the repository are included. The omitted files (e.g., env.example, docker-compose.yml) are not provided for analysis.
- The artifact itself does not contain any exploit or scanner code; it is a lab environment. The classification is based on its stated purpose in the README.
- Three additional files (env.example, docker-compose.yml, and one other) are present in the repository but were not included in the text evidence. Their content is unknown.
- Binary files were not analyzed per the evidence policy.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubflame-11/CVE-2018-9206-jquery-file-upload
Repository PoCStars: 1Created 2025-12-27ExploitCVE-2018-92069 files
Analysis
Technical assessment
A Bash script that uploads a PHP file to a vulnerable jQuery-File-Upload instance and then requests the uploaded file to confirm remote code execution.
Backdoor review
No backdoor observed in reviewed code
The reviewed text files (Dockerfile, README.md, scripts/poc.sh) set up a vulnerable environment and provide a proof-of-concept script for payload withheld. The PoC uploads a benign PHP file containing a timestamped marker and verifies its execution. No backdoor, deceptive payload, persistence, credential theft, or unrelated remote access is observed.
Classification basis and observed behavior
Classification basis
The script actively uploads a PHP file and then executes it to confirm code execution, which constitutes exploitation rather than mere detection or scanning.
scripts/poc.sh:12-13scripts/poc.sh:19scripts/poc.sh:21-22Requirements
- A running instance of Blueimp jQuery-File-Upload <= 9.22.0 with the default upload endpoint accessible.
scripts/poc.sh:5scripts/poc.sh:12-13
Observed behavior
- Sends a POST request to the server's PHP upload handler with a file containing PHP code.
scripts/poc.sh:12-13 - Checks the server response for the uploaded filename to confirm successful upload.
scripts/poc.sh:15 - Requests the uploaded PHP file via HTTP to trigger its execution on the server.
scripts/poc.sh:19 - Compares the HTTP response body to a unique marker string to confirm remote code execution.
scripts/poc.sh:21-22
Behaviors behind the backdoor verdict
Observables
- Vulnerability Context
- Payload withheldThe artifact is a lab environment and PoC for a known arbitrary file upload vulnerability in Blueimp jQuery-File-Upload.
README.md:1-3 - Poc Behavior
- Payload withheldThe PoC script demonstrates the vulnerability by uploading a harmless PHP file and verifying RCE, which is standard exploit demonstration behavior.
scripts/poc.sh:6-22
What the analysis did not establish
- Only three of nine repository files were provided as text; the remaining six files (including the vulnerable application code) were omitted.
- The analysis is based solely on static review of the provided text; the code was not executed, and its behavior in a live environment is not verified.
- 6 files in the repository are not included in the text evidence; their content is unknown.
- The analysis is limited to static review of the provided text; no dynamic execution was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubflame-11/CVE-2016-15041-mainwp-dashboard
Repository PoCStars: 0Created 2025-12-25ExploitCVE-2016-150417 files
Analysis
Technical assessment
The artifact is a Bash script (poc.sh) that exploits payload withheld, an unauthenticated stored XSS vulnerability in MainWP Dashboard <= 3.1.2. It fetches a nonce, injects a JavaScript payload via the mwp_setup_purchase_username parameter, and verifies the payload is stored.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Dockerfile, README, and a PoC shell script for payload withheld, a stored XSS vulnerability in the MainWP Dashboard WordPress plugin. The Dockerfile builds a lab environment, the README documents the vulnerability and usage, and the PoC script demonstrates the unauthenticated XSS injection. No backdoor, deceptive payload, or concealed operator-directed harm is present. The PoC script performs only the documented XSS proof-of-concept actions: fetching a nonce, injecting a benign alert() payload, and verifying storage. No persistence, credential theft, unrelated remote access, or hidden executable behavior is observed.
Classification basis and observed behavior
Classification basis
The script actively injects a malicious payload into a vulnerable application and verifies its storage, which constitutes exploitation, not just detection.
scripts/poc.sh:2scripts/poc.sh:28-34Requirements
- Target running MainWP Dashboard plugin version <= 3.1.2
README.md:52 - Network access to the target WordPress instance
scripts/poc.sh:7
Observed behavior
- Fetches a CSRF nonce from the unauthenticated setup wizard endpoint
scripts/poc.sh:16-17 - Constructs an XSS payload that breaks out of an HTML attribute using a double quote and injects an onmouseover event handler
scripts/poc.sh:29 - Sends a POST request with the XSS payload to the vulnerable endpoint without authentication
scripts/poc.sh:31-34 - Verifies the payload is stored by checking for a unique marker in the response
scripts/poc.sh:41
Behaviors behind the backdoor verdict
Observables
- Xss Payload
- Payload withheldThe PoC script injects a benign XSS payload that triggers an alert with the document domain, consistent with a standard proof-of-concept for a stored XSS vulnerability.
scripts/poc.sh:29 - Vulnerability Target
- Payload withheldThe artifact is a lab and PoC for a known CVE, with no indication of additional malicious functionality beyond demonstrating the vulnerability.
README.md:1-3
What the analysis did not establish
- A binary zip file (mainwp-3.1.2-vulnerable.zip) is present but was not analyzed; its contents could contain additional exploit or scanner code.
- Only 3 of 7 total files were provided as text; the remaining 4 files (including the binary) were omitted or not analyzed.
- One binary file (mainwp-3.1.2-vulnerable.zip, 2.5 MB) was not analyzed; only its metadata is included. The PoC script does not interact with this file, and the Dockerfile only unzips it for lab setup. No backdoor indicators are present in the analyzed text, but the zip contents were not inspected.
- Three text files (docker-compose.yml, docker-entrypoint-custom.sh, and one other) are present in the repository but their content is omitted from the evidence packet. The included files do not reference any suspicious behavior in these omitted files.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubflame-11/CVE-2017-20192-formidable-forms
Repository PoCStars: 0Created 2025-12-24ScannerCVE-2017-201925 files
Analysis
Technical assessment
A Bash script that validates the presence of CVE-2017-20192 (stored XSS) by submitting a crafted payload to a Formidable Forms instance and then checking an admin view for the injected script marker. It does not deliver the payload to a victim's browser.
Backdoor review
No backdoor observed in reviewed code
The PoC consists of a README and a bash script that automates reproduction of CVE-2017-20192 (stored XSS). The script submits a crafted form entry, logs in as admin, and checks for the XSS payload in the admin view. No backdoor, deceptive payload, or concealed operator-directed harm is present.
Classification basis and observed behavior
Classification basis
The script's primary operation is to detect and report the presence of the vulnerability by checking for a stored marker in an admin view. It does not deliver the payload to a victim browser or perform any action beyond validation. The README explicitly describes it as a 'helper script' that 'checks for the stored marker'.
README.md:16-19scripts/poc.sh:83-88Requirements
- A running instance of the vulnerable Formidable Forms plugin (< 2.05.03) with a form identified by the key 'cve-2017-20192'.
README.md:3scripts/poc.sh:7 - Network access to the target WordPress instance.
scripts/poc.sh:4
Observed behavior
- Fetches the form preview HTML to extract form_id, form_key, and field_id.
scripts/poc.sh:36-43 - Submits an unauthenticated POST request containing a crafted XSS payload to the form entry endpoint.
scripts/poc.sh:54-58 - Logs in as a WordPress administrator and fetches the admin entry view for the submitted form.
scripts/poc.sh:60-81 - Checks the admin entry view HTML for the presence of the injected script marker and reports 'VULNERABLE' or 'NOT VULNERABLE'.
scripts/poc.sh:83-88
Behaviors behind the backdoor verdict
Observables
- Script Behavior
- Payload withheldThe script's actions are entirely consistent with a legitimate PoC for the stated CVE. It does not exfiltrate data, establish persistence, or perform any unrelated actions.
scripts/poc.sh:20-30scripts/poc.sh:55-58scripts/poc.sh:83-84
What the analysis did not establish
- Evidence coverage is incomplete: 3 of 5 files in the repository were omitted from the packet, and complete_artifact_coverage is false.
- The analysis is based solely on static review of the provided source code; the script was not executed, and its behavior in a live environment is not confirmed.
- Three files (total 5) were omitted from the text evidence; their metadata indicates they are not analyzed, but their content is unavailable for review.
- Binary files were flagged as metadata-only and not analyzed, though none were reported in this packet.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubflame-11/CVE-2024-3408-dtale
Repository PoCStars: 0Created 2025-12-22ExploitCVE-2024-34086 files
Analysis
Technical assessment
The artifact provides a shell script (poc.sh) that sends HTTP requests to a D-Tale instance to enable custom filters and then injects a pandas query to execute an arbitrary OS command ('id'), confirming remote code execution. It also includes a Dockerfile to set up a vulnerable lab environment and a README with exploitation instructions.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Dockerfile, README, and a bash PoC script for CVE-2024-3408. All files describe or automate exploitation of the stated vulnerability in D-Tale. No concealed, deceptive, or operator-directed harmful behavior beyond the normal exploit was observed.
Classification basis and observed behavior
Classification basis
The script poc.sh actively sends crafted requests to a target to enable a feature and then inject a payload that executes an arbitrary OS command, which is the definition of exploit code. The README explicitly labels it as a 'Proof of Concept' and provides curl commands to achieve RCE.
scripts/poc.sh:2scripts/poc.sh:10scripts/poc.sh:21-22README.md:26-33Requirements
- A running D-Tale instance vulnerable to CVE-2024-3408 (version 3.10.0 used in lab).
Dockerfile:19README.md:7-13 - Network access to the target D-Tale instance.
scripts/poc.sh:5
Observed behavior
- Sends a GET request to /dtale/update-settings/1 to enable custom filters.
scripts/poc.sh:10 - Sends a GET request to /dtale/test-filter/1 with a malicious pandas query that executes the 'id' command via Python's os.popen.
scripts/poc.sh:21-22 - Checks the response for 'uid=' to confirm successful command execution.
scripts/poc.sh:24
Behaviors behind the backdoor verdict
Observables
- Exploit Command
- Payload withheldThe PoC script executes a command injection payload against the target D-Tale instance to demonstrate RCE, consistent with the described CVE.
scripts/poc.sh:21-22 - Hardcoded Secret
- Payload withheldThe README documents the hardcoded SECRET_KEY as part of the vulnerability description, not as a secret embedded in the PoC itself.
README.md:9
What the analysis did not establish
- Only three of six repository files were provided as text; the remaining three files (likely docker-compose.yml, start.py, and .gitignore) are omitted, but their absence does not prevent classification of the included exploit script.
- The evidence was not executed; classification is based solely on static analysis of the provided source code and documentation.
- Three additional files (metadata only) were omitted from the evidence packet and not reviewed.
- Binary content was not present; the review is limited to the supplied text files.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.