x1o3
Source-scoped identity with 1 associated PoC and 1 linked vulnerability.
Exploit catalog results
Showing 1 PoC on this page
MetasploitGrav CMS Admin Direct Install Authenticated Plugin Upload RCE
Metasploit exploitby binnekoAdded to Metasploit 2026-02-27ExploitCVE-2025-502861 file
Analysis
Technical assessment
A Metasploit module that authenticates to Grav CMS admin, uploads a malicious plugin ZIP via /admin/tools/direct-install, and executes an embedded PHP payload for remote code execution.
Backdoor review
No backdoor observed in reviewed code
The module is a standard Metasploit authenticated RCE exploit for CVE-2025-50286. It authenticates to Grav CMS, uploads a plugin ZIP containing a Metasploit-generated PHP payload, and triggers execution. No concealed backdoor, credential exfiltration, persistence mechanism, or unrelated payload delivery was observed. The cleanup routine removes the uploaded plugin directory on new Meterpreter sessions.
Classification basis and observed behavior
Classification basis
The module is a complete Metasploit exploit that authenticates, uploads a crafted plugin containing a payload, and triggers its execution to establish a session. It includes the full exploit lifecycle: check, login, payload generation, upload, and cleanup.
modules/exploits/multi/http/grav_admin_direct_install_rce_cve_2025_50286.rb:6modules/exploits/multi/http/grav_admin_direct_install_rce_cve_2025_50286.rb:108-118modules/exploits/multi/http/grav_admin_direct_install_rce_cve_2025_50286.rb:234-258Requirements
- Valid admin credentials (USERNAME, PASSWORD) for the target Grav CMS instance.
modules/exploits/multi/http/grav_admin_direct_install_rce_cve_2025_50286.rb:66-67 - Target must be running Grav CMS version <=1.7.49.5 with Admin Plugin version <=1.10.49.3.
modules/exploits/multi/http/grav_admin_direct_install_rce_cve_2025_50286.rb:18-19
Observed behavior
- Authenticates to the Grav admin panel by POSTing credentials and a login nonce.
modules/exploits/multi/http/grav_admin_direct_install_rce_cve_2025_50286.rb:176-186 - Builds a ZIP archive containing a PHP plugin that base64-decodes and evals the Metasploit payload.
modules/exploits/multi/http/grav_admin_direct_install_rce_cve_2025_50286.rb:221-258 - Uploads the malicious plugin ZIP via a multipart POST to /admin/tools/direct-install, including an extracted admin-nonce.
modules/exploits/multi/http/grav_admin_direct_install_rce_cve_2025_50286.rb:274-298 - On new Meterpreter session, cleans up the uploaded plugin directory using rm -rf.
modules/exploits/multi/http/grav_admin_direct_install_rce_cve_2025_50286.rb:301-308
Behaviors behind the backdoor verdict
Observables
- Payload Execution
- Payload withheldThe module embeds a Metasploit payload (base64-encoded) into a generated PHP plugin, which is the intended exploit mechanism.
modules/exploits/multi/http/grav_admin_direct_install_rce_cve_2025_50286.rb:255 - Cleanup Routine
- Payload withheldThe on_new_session callback removes the uploaded plugin directory after a Meterpreter session is established, which is a cleanup action, not a backdoor.
modules/exploits/multi/http/grav_admin_direct_install_rce_cve_2025_50286.rb:301-309
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The module was not executed; classification reflects the intended purpose as described in the code and metadata.
- Only the module source and metadata were reviewed; Metasploit framework mixins, libraries, and the actual payload generated at runtime are not included in the evidence.
- The review does not assess whether the exploit works as claimed or whether the target application is actually vulnerable.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.