Exploit catalog results

Showing 5 PoCs on this page

GitHub

RajChowdhury240/CVE-2025-67435-PoC

Repository PoCStars: 0Created 2026-02-06
WriteupCVE-2025-674351 file

4.9 KiB

Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical writeup describing a Zip Slip vulnerability (payload withheld) in PluckCMS. It provides a detailed explanation of the vulnerability, affected component, and exploitation steps, but does not include any executable proof-of-concept code. The only code snippet is a benign example of a PHP payload, and the exploitation steps are described in text only, with no actual exploit script provided.

Backdoor review

No backdoor observed in reviewed code

The artifact is a single README.md file describing a Zip Slip vulnerability (payload withheld) in PluckCMS. It contains no executable code, no hidden payloads, and no instructions for the reviewer to perform harmful actions. The provided PHP snippet is a benign proof-of-concept demonstrating the vulnerability, not a backdoor.

ClassificationWriteup
Model confidence95%
AuthenticationRequired
Languagesmarkdown
Target softwarePluckCMS
Attack typeszip slipremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is classified as a writeup because it is a substantive technical analysis of a vulnerability (payload withheld) without providing executable exploit or scanner code. The file is a single README.md containing a vulnerability report with a description, impact assessment, and recommendations. The only code present is a static, non-executable PHP snippet used as an example payload. The exploitation steps are described in prose, and no functional script to perform the attack or scan for the vulnerability is included.

README.md:1-112

Requirements

  • Administrative authentication to the PluckCMS admin panel is required to access the module upload functionality.README.md:26

Observed behavior

  • The document describes a vulnerability where a crafted ZIP archive with path traversal can place a malicious PHP file on the server, leading to remote code execution.README.md:32-34
  • The document provides a textual, step-by-step exploitation process, including preparing a malicious payload and uploading it via the module management interface.README.md:56-60
  • The document includes a static PHP code example that concatenates a function name to execute a system command, illustrating the type of payload that could be used.README.md:81-86
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Report
Payload withheldThe artifact is a vulnerability report for a Zip Slip RCE in PluckCMS.README.md:1
Proof Of Concept Code
Payload withheldA benign PHP snippet demonstrating command execution via string concatenation to bypass naive static analysis, typical of PoC code.README.md:81-86
Review boundaries

What the analysis did not establish

  • The evidence packet contains only the README.md file from the repository. The analysis scope indicates complete_text_evidence for this single file, but the repository may contain other files not included in this packet. The classification is based solely on the provided text.
  • Only the README.md file was provided; no other repository files were inspected.
  • The CVE record was absent from the acquired CVEList, so the vulnerability claim could not be independently verified against the official CVE description.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

RajChowdhury240/CVE-2025-67435

Repository PoCStars: 1Created 2025-12-20
WriteupCVE-2025-674351 file

3.0 KiB

Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README.md file that describes a vulnerability (CVE-2025-67435) in PluXml CMS 5.8.22. It provides a step-by-step narrative of how an authenticated administrator could achieve remote code execution by editing a theme file to include a PHP web shell. The file contains example PHP code for a web shell but does not contain any automated exploit script, scanner, or tool. It is a technical writeup with embedded code snippets for illustration.

Backdoor review

No backdoor observed in reviewed code

The artifact is a single README.md file documenting a proof of concept for payload withheld, an authenticated RCE in PluXml CMS. The file describes a manual attack path (login, edit theme, inject PHP webshell) and provides example PHP code for a webshell. No concealed, deceptive, or unrelated malicious behavior is present; the content is a straightforward disclosure of the described vulnerability.

ClassificationWriteup
Model confidence95%
AuthenticationRequired
Languagesmarkdownphphtml
Target softwarePluXml CMS 5.8.22
Attack typesremote_code_execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file that provides a technical description of a vulnerability and manual exploitation steps. It includes illustrative code snippets (a PHP web shell) but does not contain any automated exploit or scanner code. The analysis routing classification is NO_POC_CODE_IDENTIFIED, and the content is a writeup.

README.md:1-94

Requirements

  • Authentication: Log in to the PluXML administrator panel with valid administrator credentials.README.md:27
  • Access to Theme Editor: Navigate to the administration panel's theme editor for home.php.README.md:28-31

Observed behavior

  • The writeup describes replacing the content of home.php with a PHP web shell, saving the file, and then visiting the main page to execute arbitrary commands via a cmd GET parameter.README.md:35-46
  • The writeup includes an example PHP web shell that uses the system function to execute commands passed via the cmd GET parameter.README.md:54-81
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Disclosure
Payload withheldThe README documents an authenticated RCE in PluXml CMS 5.8.22 via theme editing.README.md:1-2
Payload Example
Payload withheldExample PHP webshell payload provided in the PoC instructions.README.md:38
Payload Example
Payload withheldA more elaborate webshell example is provided, using string concatenation to call system().README.md:54-81
Review boundaries

What the analysis did not establish

  • The evidence packet contains only the README.md file; no other source code, scripts, or configuration files are included.
  • The analysis routing metadata indicates NO_POC_CODE_IDENTIFIED and NO_EXECUTABLE_SOURCE_IDENTIFIED.
  • The CVE record for CVE-2025-67435 was absent from the acquired CVEList V5 dataset.
  • Only the README.md file was reviewed; no other files were present in the repository snapshot.
  • Embedded images are not analyzed; they are referenced as external GitHub user attachment URLs and could not be inspected for hidden content.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

RajChowdhury240/React2Shell-CVE-2025-55182

Repository PoCStars: 0Created 2025-12-05
ExploitCVE-2025-551822 files

979 B

Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that sends a crafted multipart/form-data POST request to a React Server Components endpoint to achieve remote code execution via unsafe deserialization.

Backdoor review

No backdoor observed in reviewed code

The repository contains a single Python script (xpl.py) that sends a crafted HTTP POST request to exploit CVE-2025-55182. The script constructs a payload targeting React Server Components deserialization and executes a user-supplied command on the target server. No backdoor, deceptive payload, or concealed operator-directed harm against the person running the PoC was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwarereact-server-dom-webpackreact-server-dom-turbopackreact-server-dom-parcel
Attack typesRemote Code ExecutionDeserialization of Untrusted Data
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script defines and invokes an exploit function that sends a malicious payload designed to execute arbitrary commands on the target server, which is the definition of exploit code.

xpl.py:5-12

Requirements

  • Target must be running a vulnerable version of React Server Components (19.0.0, 19.1.0, 19.1.1, 19.2.0) with an exposed Server Function endpoint.xpl.py:2

Observed behavior

  • Constructs a JSON payload containing a malicious prototype pollution and code injection string targeting child_process.execSync.xpl.py:6
  • Wraps the payload in a multipart/form-data request with a specific boundary and sends it via HTTP POST to the target URL.xpl.py:7-8
  • Prints the HTTP response status code and the first 200 characters of the response body.xpl.py:9
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Script
Payload withheldThe script is a straightforward proof-of-concept exploit for the stated CVE. It takes a target URL and a command, constructs the exploit payload, and prints the response. This is normal exploit behavior against the stated target.xpl.py:5-9
Command Execution
Payload withheldThis is the core of the CVE-2025-55182 exploit, executing commands on the vulnerable server, not on the machine running the PoC.xpl.py:6
Review boundaries

What the analysis did not establish

  • Only the two text files in the repository were reviewed; no binary or non-text files were present.
  • The review does not assess the safety or correctness of the exploit against the target server.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

RajChowdhury240/ThinkAdmin-CVE-2020-25540

Repository PoCStars: 1Created 2022-03-09
Not analyzedCVE-2020-255402 files
GitHub

RajChowdhury240/CVE-2018-13341

Repository PoCStars: 0Created 2021-04-05
Not analyzedCVE-2018-133413 files