cyberleelawat
Source-scoped identity with 5 associated PoCs and 7 linked vulnerabilities.
Exploit catalog results
Showing 5 PoCs on this page
GitHubcyberleelawat/CVE-2025-40602
Repository PoCStars: 1Created 2025-12-18ScannerCVE-2025-406023 files
Analysis
Technical assessment
The artifact is a Nuclei template and a README that together form a vulnerability scanner for CVE-2025-40602. The YAML template sends an HTTP GET request to /login.action, extracts the server version from the Server header, and uses matchers to identify vulnerable SonicWall SMA 1000 appliances based on version strings. It does not contain any exploit code, payloads, or steps to escalate privileges.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Nuclei detection template (payload withheld) and a README.md documentation file. The template performs a benign GET request to /login.action, extracts the Server header and SMA version, and matches the response against known vulnerable version strings. No executable payload, obfuscation, or concealed behavior is present. The README provides vulnerability information and usage instructions for the template. No backdoor, trojan, or suspicious behavior is observed.
Classification basis and observed behavior
Classification basis
The YAML file is a Nuclei template that performs version-based detection of vulnerable SonicWall SMA 1000 appliances. It sends a single GET request, extracts version information, and compares it against known vulnerable ranges. It does not attempt to exploit the vulnerability, escalate privileges, or execute any payload. The README describes the vulnerability and provides instructions for running the template as a scanner. This is consistent with a scanner classification.
CVE-2025-40602.yaml:1-70README.md:120-128Requirements
- Network access to the target SMA 1000 appliance management console
CVE-2025-40602.yaml:28-30 - Nuclei scanning engine installed
README.md:120-128
Observed behavior
- Sends an HTTP GET request to /login.action on the target
CVE-2025-40602.yaml:28-30 - Extracts the Server header value from the HTTP response
CVE-2025-40602.yaml:32-38 - Extracts the SMA version from the Server header using regex
CVE-2025-40602.yaml:40-47 - Checks if the response body contains the AMC login page title
CVE-2025-40602.yaml:49-54 - Checks if the HTTP status code is 200
CVE-2025-40602.yaml:56-58 - Compares the extracted version against known vulnerable ranges (12.4.3-03093 and earlier, 12.5.0-02002 and earlier)
CVE-2025-40602.yaml:60-70 - Reports a match if all conditions are met, indicating a potentially vulnerable target
CVE-2025-40602.yaml:49-70
Behaviors behind the backdoor verdict
Observables
- Nuclei Template
- Payload withheldDetection template that sends a GET request to /login.action and matches response headers and body to identify vulnerable SonicWall SMA 1000 appliances.
CVE-2025-40602.yaml:1-70 - Http Request
- Payload withheldThe only network request made by the template; a standard detection probe with no malicious payload.
CVE-2025-40602.yaml:28-30 - Version Check
- Payload withheldDSL matcher that checks if the extracted SMA version falls within the vulnerable range.
CVE-2025-40602.yaml:65
What the analysis did not establish
- One file (likely a PNG image) was omitted from the text evidence; its content is unknown but is not required for classification of the provided text files.
- The evidence does not include any exploit code, payloads, or privilege escalation logic, only detection logic.
- One file (LICENSE) was omitted from the text content and not reviewed; its metadata indicates it is a standard MIT license file, which is unlikely to contain executable behavior.
- Binary policy is FLAGGED_METADATA_ONLY_NOT_ANALYZED; no binary files were identified in the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubcyberleelawat/CVE-2025-20393
Repository PoCStars: 2Created 2025-12-18ScannerCVE-2025-203934 files
Analysis
Technical assessment
The artifact is a scanner that detects exposure of the Cisco Email Security Appliance login panel. It checks for a specific HTML title and extracts the AsyncOS version, but does not contain any exploit code for CVE-2025-20393.
Backdoor review
No backdoor observed in reviewed code
The repository contains a README, a Nuclei template, and a Python script that checks for exposure of a Cisco Email Security Appliance login panel. The Python script sends an HTTP GET request to a user-supplied URL, parses the response for a known title and version string, and optionally generates HTML/PDF reports. No backdoor, trojan, or deceptive payload behavior is observed in the reviewed text. The script does not execute arbitrary commands, establish persistence, exfiltrate data, or contact attacker-controlled infrastructure beyond the user-specified target.
Classification basis and observed behavior
Classification basis
The Python script and Nuclei template only detect the presence of the Cisco Email Security Appliance login panel and extract version information. They do not send any payload to exploit the Spam Quarantine feature or execute arbitrary commands. The README explicitly refers to the script as an 'EXPOSURE CHECK' and a 'Scanner'.
cve_2025_20393.py:3README.md:128README.md:139Requirements
- Target URL of a potentially affected Cisco appliance
cve_2025_20393.py:185
Observed behavior
- Sends an HTTP GET request to the /login endpoint of the target
cve_2025_20393.py:206-212 - Checks if the response body contains the title 'Cisco Email Security Appliance'
cve_2025_20393.py:217-220 - Extracts the AsyncOS version from the response body using a regex
cve_2025_20393.py:218-221 - Reports exposure status and optionally generates HTML/PDF reports
cve_2025_20393.py:223-270
Behaviors behind the backdoor verdict
Observables
- Network Request
- Payload withheldThe script performs an HTTP GET to the target specified via -u/--url, which is the expected behavior for a vulnerability scanner or exposure checker.
cve_2025_20393.py:196-212 - File Creation
- Payload withheldWhen the -r/--report flag is used, the script writes CVE-2025-20393-report.html and CVE-2025-20393-report.pdf to the specified directory. This is a documented feature and does not exhibit hidden or malicious behavior.
cve_2025_20393.py:252-270 - Information Disclosure
- Payload withheldThe get_reporter_name() function gathers the local OS username and hostname for inclusion in generated reports. This is a privacy consideration but is not a backdoor or trojan; the data is only used locally in the report and is not transmitted externally.
cve_2025_20393.py:39-51
What the analysis did not establish
- One file (likely a GIF image) was omitted from the analysis as it was flagged as non-text media.
- The evidence does not include any exploit code; the artifact only performs detection.
- One file (unclassified, 35149 bytes) was not provided as readable text and was not analyzed; its content is unknown.
- The review is limited to static analysis of the supplied text; no dynamic execution or behavioral analysis was performed.
- The Python script imports standard libraries (requests, reportlab) and does not exhibit suspicious imports, but the review cannot guarantee the absence of supply-chain risks in those dependencies.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubcyberleelawat/FreePBX-Multiple-CVEs-2025
Repository PoCStars: 1Created 2025-12-16ScannerCVE-2025-61675CVE-2025-61678CVE-2025-660395 files
Analysis
Technical assessment
The artifact contains three Nuclei YAML templates and a README that detect vulnerable FreePBX instances by extracting the version from the admin panel and comparing it against known vulnerable ranges. The templates do not send exploit payloads; they only perform version fingerprinting and matching.
Backdoor review
No backdoor observed in reviewed code
The repository contains three Nuclei YAML templates and a README for detecting known FreePBX vulnerabilities. The templates perform only non-invasive version detection via HTTP GET requests and regex matching; they do not execute any exploit payloads, upload files, or establish remote access. No concealed, deceptive, or operator-directed harmful behavior is present in the reviewed text files.
Classification basis and observed behavior
Classification basis
All three YAML templates only extract the FreePBX version and compare it against known vulnerable ranges; they do not send any SQL injection, file upload, or authentication bypass payloads. The README explicitly states the detection is non-invasive and does not attempt exploitation. This is consistent with a vulnerability scanner, not an exploit.
CVE-2025-61675.yaml:24-52CVE-2025-61678.yaml:24-52CVE-2025-66039.yaml:24-52README.md:42Requirements
- Target must expose the FreePBX administration panel at /admin/config.php.
CVE-2025-61675.yaml:25-26 - Nuclei engine must be installed to execute the templates.
README.md:149-150
Observed behavior
- Sends a GET request to /admin/config.php and extracts the FreePBX version using a regex.
CVE-2025-61675.yaml:24-34 - Matches the response body for FreePBX-specific strings and a 200 status code.
CVE-2025-61675.yaml:36-48 - Compares the extracted version against vulnerable version ranges using a DSL expression.
CVE-2025-61675.yaml:50-52 - README states the detection is non-invasive and does not attempt to exploit the vulnerabilities.
README.md:42
Behaviors behind the backdoor verdict
Observables
- Nuclei Template
- Payload withheldTemplate performs a GET request to /admin/config.php, extracts the FreePBX version via regex, and matches on version range and page content. No exploit payload is sent.
CVE-2025-61675.yaml:24-52 - Nuclei Template
- Payload withheldTemplate performs a GET request to /admin/config.php, extracts the FreePBX version via regex, and matches on version range and page content. No file upload or shell payload is present.
CVE-2025-61678.yaml:24-52 - Nuclei Template
- Payload withheldTemplate performs a GET request to /admin/config.php, extracts the FreePBX version via regex, and matches on version range and page content. No forged Authorization header or authentication bypass attempt is made.
CVE-2025-66039.yaml:24-52 - Repository Metadata
- Payload withheldREADME identifies the author and organization. This is standard metadata and does not indicate backdoor behavior.
README.md:200-202
What the analysis did not establish
- One text file (likely an image) was omitted from the packet; its content is not available for analysis.
- The templates are not executed; classification is based solely on static analysis of the provided YAML and README content.
- One file (unclassified, 35149 bytes) was not analyzed because it was flagged as binary/metadata-only; its content is unknown.
- The review is limited to the supplied text evidence; no dynamic analysis or execution was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubcyberleelawat/CVE-2025-55182
Repository PoCStars: 1Created 2025-12-07ExploitCVE-2025-551825 files
Analysis
Technical assessment
The primary artifact is a Python script (CVE-2025-55182.py) that constructs and sends a malicious multipart/form-data POST request to a target server. The payload exploits a prototype pollution vulnerability in React Flight Protocol deserialization to achieve remote code execution by injecting a JavaScript payload that uses Node.js child_process.spawnSync to execute an attacker-supplied command and exfiltrates the output via a crafted redirect error.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Python exploit script, a README, and a Nuclei template, all targeting CVE-2025-55182. The Python script sends a crafted multipart POST request to execute a user-supplied command on a vulnerable React server and retrieves output via the X-Action-Redirect header. The Nuclei template performs the same attack with a hardcoded 'id' command. The README documents usage and defensive scanning. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit was observed in the reviewed text.
Classification basis and observed behavior
Classification basis
The Python script CVE-2025-55182.py is explicitly designed to execute arbitrary commands on a remote target. It builds a payload that injects and runs code via spawnSync (lines 45-50), sends it to a target (lines 120-127), and retrieves the command output (lines 134-146). This constitutes an exploit, not a scanner or writeup.
CVE-2025-55182.py:2-5CVE-2025-55182.py:45-50CVE-2025-55182.py:120-127CVE-2025-55182.py:134-146Requirements
- Target must be running a vulnerable version of React Server Components (19.0.0, 19.1.0, 19.1.1, 19.2.0) with an exposed Server Function endpoint.
CVE-2025-55182.py:2-5README.md:15-27 - The target server must accept multipart/form-data POST requests to the Server Function endpoint.
CVE-2025-55182.py:113-127
Observed behavior
- The script constructs a JSON payload containing a malicious _prefix string that executes a shell command via Node.js child_process.spawnSync and throws a custom error to exfiltrate the output.
CVE-2025-55182.py:45-50 - The script sends the payload as a multipart/form-data POST request to the target URL with a Next-Action header.
CVE-2025-55182.py:99-127 - The script parses the HTTP response, specifically looking for an X-Action-Redirect header containing the command output, and prints it to the console.
CVE-2025-55182.py:134-146
Behaviors behind the backdoor verdict
Observables
- Exploit Mechanism
- Payload withheldThe payload structure in CVE-2025-55182.py (lines 53-63) and cve-2025-55182.yaml (line 46) uses these techniques to achieve RCE on the target server.
CVE-2025-55182.py:53-63cve-2025-55182.yaml:46 - Command Execution
- Payload withheldThe Python script (line 46) and Nuclei template (line 46) execute arbitrary shell commands on the target server.
CVE-2025-55182.py:46cve-2025-55182.yaml:46 - Output Exfiltration
- Payload withheldThe exploit retrieves command output by throwing a crafted error that sets the X-Action-Redirect header (CVE-2025-55182.py lines 48-49, 134-144; cve-2025-55182.yaml line 46, 104-105).
CVE-2025-55182.py:48-49CVE-2025-55182.py:134-144cve-2025-55182.yaml:46cve-2025-55182.yaml:104-105
What the analysis did not establish
- The evidence packet reports complete_artifact_coverage as false; two files (scanner.sh and another unspecified file) are omitted from the text content, so the full repository content is not available for analysis.
- The analysis is based solely on the provided source code text; the code was not executed, and its effectiveness or safety is not verified.
- Two files (scanner.sh and one other) were present in the repository but not included in the text evidence; their content was not reviewed.
- Binary content was flagged as metadata-only and not analyzed, though no binary files were identified in the artifact.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.