x1o3
Source-scoped identity with 1 associated PoC and 1 linked vulnerability.
Exploit catalog results
Showing 1 PoC on this page
GitHubx1o3/CVE-2025-50286
Repository PoCStars: 0Created 2026-02-28ExploitCVE-2025-502866 files
Analysis
Technical assessment
A Metasploit module that exploits an authenticated RCE vulnerability (CVE-2025-50286) in Grav CMS by uploading a malicious plugin via the Direct Install interface.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Metasploit module and documentation for CVE-2025-50286, an authenticated RCE in Grav CMS. The module performs the disclosed exploit: authenticating to the admin panel, uploading a crafted plugin ZIP containing a Metasploit payload, and triggering execution. The code uses standard Metasploit APIs (Rex::Zip, Rex::MIME, payload.encoded) and cleans up the uploaded plugin directory on session creation. No concealed, unrelated, or deceptive behavior was found.
Classification basis and observed behavior
Classification basis
The primary artifact is a complete Metasploit module (grav_admin_direct_install_rce_cve_2025_50286.rb) that implements the full exploitation chain: authentication, malicious plugin generation, upload, and payload execution to obtain a reverse shell. The README and documentation describe its use as an exploit.
grav_admin_direct_install_rce_cve_2025_50286.rb:1-310README.md:1-3Requirements
- Valid administrative credentials for the target Grav CMS instance.
grav_admin_direct_install_rce_cve_2025_50286.rb:66-67 - Target must be running a vulnerable version of Grav CMS (<=1.7.49.5) with the Admin Plugin (<=1.10.49.3).
grav_admin_direct_install_rce_cve_2025_50286.rb:18-19
Observed behavior
- Authenticates to the Grav admin panel using provided credentials.
grav_admin_direct_install_rce_cve_2025_50286.rb:109-110 - Generates a ZIP archive containing a malicious PHP plugin with an embedded base64-encoded payload.
grav_admin_direct_install_rce_cve_2025_50286.rb:221-232 - Uploads the malicious plugin ZIP via a multipart POST request to /admin/tools/direct-install.
grav_admin_direct_install_rce_cve_2025_50286.rb:274-292 - The uploaded PHP plugin is automatically loaded and executed by Grav, establishing a reverse shell or Meterpreter session.
grav_admin_direct_install_rce_cve_2025_50286.rb:253-256 - Cleans up the uploaded plugin directory after a session is established.
grav_admin_direct_install_rce_cve_2025_50286.rb:301-308
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the disclosed exploit behavior for CVE-2025-50286 and matches the repository description.
grav_admin_direct_install_rce_cve_2025_50286.rb:234-259 - Cleanup Behavior
- Payload withheldThis is a standard post-exploitation cleanup step and does not indicate hidden persistence or data exfiltration.
grav_admin_direct_install_rce_cve_2025_50286.rb:301-309
What the analysis did not establish
- One binary file (exampleplugin.zip) was flagged and not analyzed; its content is unknown.
- Two text files (LICENSE, docker_setup/docker-compose.yml) were omitted from the packet content.
- The analysis is based solely on static review of the provided source code; the exploit was not executed or verified.
- One binary file (docker_setup/exampleplugin.zip) was not inspected; it is described as a lab setup component and is not referenced by the exploit module.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.