KrE80r
Source-scoped identity with 6 associated PoCs and 6 linked vulnerabilities.
Exploit catalog results
Showing 6 PoCs on this page
GitHubKrE80r/CVE-2025-34299-lab
Repository PoCStars: 0Created 2025-12-11WriteupCVE-2025-342995 files
Analysis
Technical assessment
The artifact is a README and Dockerfile providing a test environment setup for CVE-2025-34299. It describes the vulnerability and how to verify the vulnerable endpoint is reachable, but contains no exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The repository contains only a Dockerfile and a README.md for setting up a vulnerable Monsta FTP test environment. No executable payload, obfuscated code, or concealed behavior is present. The Dockerfile downloads a known vulnerable version of Monsta FTP and the README provides standard documentation and testing instructions. No backdoor, trojan, or suspicious behavior is observed.
Classification basis and observed behavior
Classification basis
The artifact consists of a Dockerfile that sets up a vulnerable Monsta FTP instance and a README that documents the vulnerability and provides a manual verification curl command. It does not contain any code that automatically exploits the vulnerability or scans for it; it is a technical writeup with setup instructions.
README.md:1-89Dockerfile:1-28Requirements
- A running instance of Monsta FTP version 2.10.4 (vulnerable) is required for testing.
README.md:63
Observed behavior
- The README instructs users to send a POST request to the vulnerable API endpoint to verify it is reachable, expecting a CONNECTION_FAILURE_ERROR response.
README.md:52-58
Behaviors behind the backdoor verdict
Observables
- Vulnerable Software Deployment
- Payload withheldThe Dockerfile installs a vulnerable version of Monsta FTP for testing purposes, consistent with the stated CVE-2025-34299 lab intent.
Dockerfile:17-20 - Api Endpoint Disclosure
- Payload withheldThe README documents the vulnerable API endpoint and provides a curl command to test it, which is normal for a PoC lab environment.
README.md:18-23README.md:52-55
What the analysis did not establish
- Only 2 of 5 files in the repository are included in the evidence; 3 files are omitted.
- The evidence does not include any executable exploit or scanner code, only documentation and a Dockerfile.
- Three files in the repository (total 5 files) were omitted from the text evidence and not reviewed; their metadata indicates they are not executable source code.
- The downloaded Monsta FTP zip file is not included in the evidence and was not analyzed for pre-existing backdoors, but the Dockerfile retrieves it from a public archive URL with no modification.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubKrE80r/CVE-2024-44902-env
Repository PoCStars: 0Created 2025-12-10ScannerCVE-2024-449026 files
Analysis
Technical assessment
The artifact is a deliberately vulnerable ThinkPHP environment designed for validating a nuclei template scanner. It contains a vulnerable application with insecure deserialization endpoints but no exploit or scanner code itself.
Backdoor review
No backdoor observed in reviewed code
The repository is a deliberately vulnerable ThinkPHP environment for CVE-2024-44902 validation. The reviewed text files (README, controllers, route) describe and implement the intended insecure deserialization vulnerability. No concealed backdoor, deceptive payload, or operator-directed harm is present in the supplied evidence.
Classification basis and observed behavior
Classification basis
The artifact is a vulnerable environment for validating a nuclei template, as stated in the README. It contains no exploit or scanner code; the nuclei template is referenced but not included. The application code only provides the vulnerable target.
README.md:3README.md:40Requirements
- A nuclei template (CVE-2024-44902.yaml) must be supplied externally to perform the scan.
README.md:40
Observed behavior
- The application exposes two endpoints (/api/sync and /api/import) that unserialize user-supplied data, simulating a vulnerable target for a scanner.
app/controller/Api.php:38app/controller/Api.php:64
Behaviors behind the backdoor verdict
Observables
- Vulnerable Endpoint
- Payload withheldThe README and route file define this endpoint, and the Api controller implements it with unserialize(urldecode($data)). This is the documented CVE-2024-44902 vulnerability, not a backdoor.
README.md:54route/app.php:10app/controller/Api.php:56-64 - Vulnerable Endpoint
- Payload withheldThe route file and Api controller implement this endpoint with unserialize(base64_decode($payload)). This is the documented CVE-2024-44902 vulnerability, not a backdoor.
route/app.php:9app/controller/Api.php:27-38
What the analysis did not establish
- The nuclei template (CVE-2024-44902.yaml) is not included in the evidence; only the vulnerable target application is provided.
- Two text files (likely configuration files) are omitted from the evidence, but their absence does not affect the classification of the primary artifact as a vulnerable environment.
- Two files (Dockerfile, docker-compose.yml) were omitted from text analysis; their metadata shows no executable payloads, but their content was not reviewed.
- Binary analysis was not performed; the artifact may contain unexamined binary content in the omitted files.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubKrE80r/CVE-2020-13756-env
Repository PoCStars: 0Created 2025-12-06ScannerCVE-2020-137564 files
Analysis
Technical assessment
The artifact sets up a vulnerable Docker environment for CVE-2020-13756 and provides a curl command to verify the vulnerability by checking for a specific output string, which is scanner behavior.
Backdoor review
No backdoor observed in reviewed code
The repository provides a deliberately vulnerable Docker environment for CVE-2020-13756. The index.php file directly passes a user-supplied GET parameter to the known-vulnerable getSelectorsBySpecificity() function, which is the documented CVE behavior. No concealed backdoor, unrelated payload, persistence mechanism, or operator-directed harm is present in the reviewed text files.
Classification basis and observed behavior
Classification basis
The primary artifact is a vulnerable test environment and verification instructions. The index.php script is a deliberately vulnerable test harness, not an exploit. The README provides a curl command that tests for the vulnerability by checking for a specific output string ('VULN_TEST'), which is scanner behavior (detection/validation) rather than exploitation. No standalone exploit code is present.
README.md:1-3README.md:39-46index.php:1-20Requirements
- Docker must be installed and running to build and run the container.
README.md:18 - The target application must be accessible via HTTP on the specified port.
README.md:43
Observed behavior
- Builds a Docker image with a vulnerable version of Sabberworm PHP CSS Parser (8.3.0) and a test script that passes user input to the vulnerable getSelectorsBySpecificity function.
Dockerfile:12-13index.php:14 - Provides a curl command that sends a payload to the test script and checks if the response contains 'VULN_TEST', indicating successful code execution.
README.md:42-44 - Includes a Nuclei template reference for automated vulnerability scanning.
README.md:50-52
Behaviors behind the backdoor verdict
Observables
- Vulnerable Code
- Payload withheldThis is the exact vulnerable pattern described in CVE-2020-13756, where unsanitized user input reaches eval(). It is the intended PoC behavior, not a backdoor.
index.php:14 - Vulnerable Dependency
- Payload withheldThe Dockerfile installs the vulnerable version of the library, consistent with the stated CVE scope.
Dockerfile:12-13
What the analysis did not establish
- One file (docker-compose.yml) is omitted from the text evidence; its content is unknown.
- The Nuclei template file (CVE-2020-13756.yaml) is referenced but not included in the evidence.
- One file (docker-compose.yml, 79 bytes) was not included as text content; only its metadata was provided. Its omission is noted but does not indicate backdoor behavior given the complete coverage of the core application files.
- Binary files were not inspected; the binary policy is FLAGGED_METADATA_ONLY_NOT_ANALYZED, and no binary files were identified in the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubKrE80r/cve-2021-3007-vulnerable
Repository PoCStars: 0Created 2025-12-05ScannerCVE-2021-30076 files
Analysis
Technical assessment
The artifact is a deliberately vulnerable test environment designed to validate detection of payload withheld by security scanners. It includes a Dockerfile, a README with instructions for testing with nuclei, and a PHP application that deserializes user input. The primary stated purpose is scanner validation, not exploitation.
Backdoor review
No backdoor observed in reviewed code
The repository is a deliberately vulnerable test environment for payload withheld. All supplied files (Dockerfile, README.md, index.php) openly document and implement the intended insecure deserialization vulnerability. No concealed backdoor, unrelated payload, or deceptive behavior was observed.
Classification basis and observed behavior
Classification basis
The artifact's primary stated purpose is to serve as a test environment for validating security scanner detection of payload withheld. The README explicitly describes it as a 'vulnerable test environment for validating payload withheld detection in security scanners' and 'Created for nuclei template validation'. While it contains a vulnerable application that could be exploited, the artifact itself is designed to be detected by scanners, not to actively exploit a target. The included manual exploitation test is for verifying the environment's vulnerability, not for attacking external systems.
README.md:7README.md:130Requirements
- Docker and docker-compose must be installed to run the environment.
README.md:3 - The nuclei scanner is optionally required for validation.
README.md:33
Observed behavior
- The PHP application accepts base64-encoded serialized data via POST or GET parameters and deserializes it using unserialize().
index.php:19-39 - The README provides a manual exploitation test command that sends a serialized payload to trigger RCE and expects a specific response.
README.md:49-52 - The README states the environment is for validating payload withheld detection in security scanners and for nuclei template validation.
README.md:7README.md:130
Behaviors behind the backdoor verdict
Observables
- Vulnerable Code
- Payload withheldThe index.php file intentionally deserializes untrusted user input, which is the documented payload withheld vulnerability.
index.php:36-39 - Documented Vulnerability
- Payload withheldThe README and Dockerfile explicitly state the environment is intentionally vulnerable to payload withheld for security testing.
README.md:7Dockerfile:3-5
What the analysis did not establish
- Three of six total files were omitted from the text evidence (docker-compose.yml, LICENSE, and one other). Their content is not available for analysis.
- The evidence does not include the nuclei template (payload withheld.yaml) referenced in the README.
- The analysis is based solely on static review of the provided text; no code was executed.
- Three additional files (docker-compose.yml, LICENSE, and a nuclei template) were present in the repository metadata but their content was not included in the evidence packet. Based on the file names and the repository's stated purpose, they are unlikely to contain backdoor behavior, but their absence is a limitation.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubKrE80r/cve-2025-13486-vuln-setup
Repository PoCStars: 0Created 2025-12-04ScannerCVE-2025-134867 files
Analysis
Technical assessment
The artifact is a Docker-based test environment for CVE-2025-13486. It sets up a vulnerable WordPress instance with ACF Extended 0.9.0.5 and provides instructions for testing the vulnerability using a Nuclei template. The artifact itself does not contain exploit code; it only configures a target and references an external scanner (Nuclei).
Backdoor review
No backdoor observed in reviewed code
The repository is a Docker-based test environment for CVE-2025-13486. All reviewed scripts (entrypoint.sh, download-plugins.sh, Dockerfile) and documentation (README.md) perform only expected setup actions: downloading vulnerable plugin versions, installing WordPress, and configuring a test nonce exposure. No concealed executable behavior, credential exfiltration, persistence mechanisms, or unrelated payloads were observed.
Classification basis and observed behavior
Classification basis
The artifact is classified as a scanner because its primary purpose is to set up a vulnerable environment for testing and then instruct the user to run an external scanner (Nuclei) to check for the vulnerability. The README explicitly states 'nuclei -t CVE-2025-13486.yaml -u http://localhost:8888' as the testing command. The provided curl commands in the README are for manual verification of the vulnerability's presence, not for exploitation. The artifact does not contain any code that autonomously exploits the vulnerability to achieve code execution or other impact.
README.md:1README.md:15README.md:33-38Requirements
- Requires Docker and Docker Compose to build and run the environment.
README.md:12 - Requires the vulnerable ACF Extended plugin (version 0.9.0.5) and its dependency ACF Pro to be placed in the plugins directory.
README.md:22-28 - Requires the Nuclei scanner and its CVE-2025-13486.yaml template to perform the actual vulnerability check.
README.md:15
Observed behavior
- Builds a Docker container running WordPress with PHP 7.4 and Apache.
Dockerfile:1 - Downloads the vulnerable ACF Extended plugin version 0.9.0.5.
download-plugins.sh:7-8 - Installs WordPress, the ACF Pro dependency, and the vulnerable ACF Extended plugin inside the container.
entrypoint.sh:48-71 - Modifies the active theme's functions.php to expose the ACF nonce on the frontend, simulating a real-world vulnerable site.
entrypoint.sh:89-112 - Provides manual curl commands to extract the nonce and send a crafted POST request to the vulnerable AJAX endpoint, demonstrating the vulnerability check.
README.md:33-38
Behaviors behind the backdoor verdict
Observables
- Test Environment Modification
- Payload withheldThis is explicitly documented as a test-only simulation of real-world sites that have ACFE forms deployed. It is not a backdoor; it enables the PoC exploit to function in a minimal WordPress setup.
entrypoint.sh:74-116 - Credential Disclosure
- Payload withheldThese are hardcoded test credentials for a local Docker environment, not a concealed backdoor. They are disclosed in the README and entrypoint output.
entrypoint.sh:51-52README.md:14
What the analysis did not establish
- The evidence packet reports 3 unclassified files (out of 7 total) that were not included as text, so the full artifact content is not available for analysis.
- The Nuclei template file (CVE-2025-13486.yaml) referenced in the README is not included in the provided evidence.
- The analysis is based solely on the supplied text files; no code was executed to confirm behavior.
- Three text files (docker-compose.yml, .env, CVE-2025-13486.yaml) were present in the repository but not included in the evidence packet. Their content was not reviewed.
- Binary analysis was not performed; no binary files were identified in the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.