segfault-it

GitHub · Repository owner · Source ID 24494334
Source profile

Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.

Showing 2 PoCs on this page

GitHub

segfault-it/CVE-2025-25257

Repository PoC1Created 2025-09-21ExploitCVE-2025-252572 files

3.9 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2025-25257, an unauthenticated SQL injection in FortiWeb, to achieve remote code execution and spawn a reverse shell.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python exploit for CVE-2025-25257, a SQL injection vulnerability in FortiWeb. The README and code explicitly state the exploit delivers a reverse shell to a hardcoded IP address (payload withheld:payload withheld) and instructs the operator to change it. The code performs the disclosed SQL injection and file write operations to achieve remote code execution on the target FortiWeb server. No concealed, unrelated, or operator-harming behavior was found.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareFortinet FortiWeb
Attack typessql_injectionremote_code_execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script performs a multi-step attack: SQL injection to write a file, then triggers execution of that file to spawn a reverse shell. This is active exploitation, not mere detection or scanning.

watchtowel.py:36-41README.md:3-4

Requirements

  • Target running vulnerable FortiWeb version with accessible /api/fabric/device/status endpoint.watchtowel.py:14
  • Attacker must modify hardcoded reverse shell IP and port.watchtowel.py:33

Observed behavior

  • Injects SQL via Authorization header Bearer token to drop, create, and populate a table in fabric_user database.watchtowel.py:18watchtowel.py:67-70
  • Writes a Python reverse shell payload into the table in 16-byte hex-encoded chunks.watchtowel.py:51-58
  • Uses SQL SELECT ... INTO OUTFILE to write the payload to /var/log/lib/python3.10/site-packages/k.pth.watchtowel.py:34watchtowel.py:60-65
  • Triggers execution of the .pth file by requesting /cgi-bin/ml-draw.py, causing the reverse shell to connect back.watchtowel.py:31watchtowel.py:43-46
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Ipv4
Payload withheldHardcoded reverse shell callback address in the exploit payload, disclosed in the README and code comments.watchtowel.py:33README.md:4
Port
Payload withheldHardcoded reverse shell callback port in the exploit payload, disclosed in the README and code comments.watchtowel.py:33README.md:4
Review boundaries

What the analysis did not establish

  • Evidence consists of source code only; no runtime output, network captures, or target interaction logs are provided.
  • README states the code was modified from other exploits and tested on the author's environment, but no verification of functionality is included in the evidence.
  • No binary or compiled files were present for inspection.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

segfault-it/cve-2022-41352

Repository PoC8Created 2022-10-10Not analyzedCVE-2022-413524 files

23.0 KiB

GitHubPoC details