b1g-b33f

GitHub · Repository owner · Source ID 130265537
Source profile

Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.

Showing 2 PoCs on this page

GitHub

b1g-b33f/CVE-2020-14882

Repository PoC1Created 2025-12-10ExploitCVE-2020-148822 files

1,015 B

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Bash script that sends a crafted POST request to a WebLogic Console path traversal endpoint to achieve unauthenticated remote code execution via a ShellSession payload.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README and a Bash script that sends a crafted POST request to a WebLogic server to test for CVE-2020-14882/14883. The script constructs a URL with a path traversal and includes a hardcoded command execution payload in the POST data. This is consistent with a proof-of-concept exploit for the stated CVE. No concealed, deceptive, or operator-directed harmful behavior beyond the advertised exploit test was observed.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesBash
Target softwareOracle WebLogic Server
Attack typesRemote Code ExecutionAuthentication Bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a payload designed to execute a command on the target, which is the definition of an exploit. It does not merely check for the vulnerability; it attempts to trigger remote code execution.

cve-2020-14882.sh:10-11

Requirements

  • Target must be running a vulnerable version of Oracle WebLogic Server (10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0).cve-2020-14882.sh:1-11
  • Attacker must have network access to the target WebLogic Console.cve-2020-14882.sh:1-11

Observed behavior

  • Constructs a URL using a path traversal sequence to bypass authentication on the WebLogic Console.cve-2020-14882.sh:8
  • Sends a POST request with a payload that executes an arbitrary shell command (curl) on the target server.cve-2020-14882.sh:10-11
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Payload
Payload withheldThe script includes a hardcoded command to be executed on the target via the WebLogic vulnerability, which is the expected behavior of a CVE-2020-14882/14883 PoC.cve-2020-14882.sh:11
Review boundaries

What the analysis did not establish

  • The script contains a placeholder IP address (x.x.x.x) and requires modification before use, but the exploit logic is complete.
  • The evidence does not include any output or verification that the exploit was successfully executed.
  • Only the two text files (README.md and cve-2020-14882.sh) were provided and reviewed. No other files exist in the repository according to the inventory.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

b1g-b33f/CVE-2020-36708

Repository PoC2Created 2025-08-18ScannerCVE-2020-367082 files

1.7 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A bash script that sends a crafted HTTP request to a target WordPress site to trigger an SSRF via the epsilon_framework_ajax_action AJAX handler, confirming the presence of CVE-2020-36708 without executing a payload on the target.

Backdoor review

No backdoor observed in reviewed code

The artifact contains a shell script PoC for CVE-2020-36708 and a README. The script sends a crafted HTTP request to a target WordPress site to trigger an SSRF via the epsilon_framework_ajax_action vulnerability. No backdoor, deceptive payload, or concealed harmful behavior is present.

ClassificationScanner
Model confidence95%
AuthenticationNot required
Languagesbash
Target softwareWordPressEpsilon Framework
Attack typesssrffunction injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script only sends a single HTTP request designed to cause the target server to make an outbound connection to a user-supplied domain. It does not deliver a payload, establish a shell, or perform any action on the target beyond triggering the vulnerable function. The README explicitly describes this as a non-destructive SSRF demonstration to confirm arbitrary function execution.

README.md:13CVE-2020-36708.sh:6-13

Requirements

  • Target WordPress site running a vulnerable version of a theme using the Epsilon Framework.README.md:4
  • A collaborator or webhook domain to receive the outbound request.CVE-2020-36708.sh:4

Observed behavior

  • Prompts the user for a target domain and a collaborator domain.CVE-2020-36708.sh:3-4
  • Sends a POST request to /wp-admin/admin-ajax.php with payload withheld and parameters that invoke the Requests::request_multiple method to make the server fetch a URL on the collaborator domain.CVE-2020-36708.sh:6-13
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
Payload withheldTarget endpoint for the CVE-2020-36708 exploitCVE-2020-36708.sh:6
Parameter
Payload withheldVulnerable AJAX action used to trigger function injectionCVE-2020-36708.sh:8
Parameter
Payload withheldClass and method invoked via the vulnerabilityCVE-2020-36708.sh:9-10
Url
Payload withheldCollaborator/webhook URL used to confirm SSRFCVE-2020-36708.sh:11
Review boundaries

What the analysis did not establish

  • Only the supplied text files were analyzed; no binary or opaque content was present.
  • The script's behavior is inferred from static analysis of the source code; it was not executed.
  • Only the two text files (CVE-2020-36708.sh and README.md) were reviewed; no other files exist in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.