skumar
Source-scoped identity with 1 associated PoC and 3 linked vulnerabilities.
Exploit catalog results
Showing 1 PoC on this page
ExploitDBOpenKM 6.3.12 - Multiple
ExploitDB exploitPublished 2026-04-29ExploitCVE-2026-41917CVE-2026-42425CVE-2026-427851 file
Analysis
Technical assessment
Python script that exploits multiple vulnerabilities in OpenKM 6.3.12, including authenticated Local File Inclusion (LFI), Remote Code Execution (RCE) via scripting engine, and SQL injection to extract user password hashes, with an optional hash cracking routine.
Backdoor review
No backdoor observed in reviewed code
The reviewed Python script is a proof-of-concept exploit for OpenKM vulnerabilities (LFI, RCE, SQLi). It performs only the advertised exploitation actions against a user-supplied target. No concealed backdoor, unrelated payload, or deceptive operator-directed harm was observed in the supplied text.
Classification basis and observed behavior
Classification basis
The script contains functions that actively exploit vulnerabilities: lfi() reads arbitrary files, rce() executes arbitrary commands, and sqli() extracts database contents. These go beyond detection and perform the exploitation actions.
exploits/multiple/webapps/52520.py:124-154exploits/multiple/webapps/52520.py:157-194exploits/multiple/webapps/52520.py:277-333Requirements
- Valid credentials for OpenKM (default okmAdmin:admin used if not provided)
exploits/multiple/webapps/52520.py:385-386 - Target OpenKM instance accessible at a base URL
exploits/multiple/webapps/52520.py:361
Observed behavior
- Authenticates to OpenKM using provided or default credentials
exploits/multiple/webapps/52520.py:105-120 - Performs Local File Inclusion by loading arbitrary files via the admin Scripting interface
exploits/multiple/webapps/52520.py:124-154 - Executes arbitrary operating system commands via Java code evaluated in the admin Scripting interface
exploits/multiple/webapps/52520.py:157-194 - Extracts user password hashes via SQL injection on the admin DatabaseQuery page and optionally cracks them with hashcat
exploits/multiple/webapps/52520.py:277-333
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe script's functions lfi(), rce(), sqli(), and crack_password() implement the advertised vulnerabilities. All actions are directed at the target provided via --url and require explicit user interaction.
exploits/multiple/webapps/52520.py:124-154exploits/multiple/webapps/52520.py:157-194exploits/multiple/webapps/52520.py:277-333exploits/multiple/webapps/52520.py:197-272 - Library Installation
- Payload withheldThe check_and_install_libraries() function installs missing dependencies. This is a convenience feature for the user and does not introduce hidden behavior.
exploits/multiple/webapps/52520.py:24-36 - External Command Execution
- Payload withheldThe crack_password() function runs hashcat on user-supplied wordlists against hashes extracted from the target. This is part of the advertised SQLi + cracking workflow and is not a backdoor.
exploits/multiple/webapps/52520.py:268-269
What the analysis did not establish
- Evidence is limited to the single Python file; external dependencies (e.g., hashcat, wordlists) and referenced resources are not included.
- The script's actual effectiveness or safety is not verified; classification is based solely on code intent.
- Only the single Python file was reviewed; no external resources, libraries, or referenced URLs were fetched or analyzed.
- Binary files were not inspected (none present in this packet).
- The review does not assess the safety or correctness of the exploit code itself, only the absence of backdoor behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.