Maksim Rogov
Source-scoped identity with 10 associated PoCs and 12 linked vulnerabilities.
Exploit catalog results
Showing 10 PoCs on this page
MetasploitGhost CMS Remote Code Execution
Metasploit exploitby Cristian-Alexandru StaicuAdded to Metasploit 2026-08-05ExploitCVE-2026-22594CVE-2026-290531 file
Analysis
Technical assessment
A Metasploit module that exploits CVE-2026-29053 (RCE via malicious themes) and optionally CVE-2026-22594 (2FA bypass) in Ghost CMS. It authenticates, injects a Handlebars SSTI payload into a theme archive, uploads and activates the theme, then triggers code execution.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a standard exploit for CVE-2026-29053 (Ghost CMS RCE via malicious themes) and CVE-2026-22594 (2FA bypass). All behavior is consistent with the stated exploit purpose: authenticating to Ghost CMS, crafting a theme containing a payload, uploading it, and triggering execution. No concealed backdoor, unrelated payload, or operator-directed harm was observed.
Classification basis and observed behavior
Classification basis
The module is a fully implemented Metasploit exploit that authenticates, injects a payload into a theme, uploads it, and triggers remote code execution. It is not a scanner, writeup, or stub.
modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb:1-712Requirements
- Valid credentials or authentication material (password, API key, session cookie, session secret, or invite link) for a Ghost CMS instance.
modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb:87-98 - Target Ghost CMS version between 0.7.2 and 6.19.0 inclusive.
modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb:44
Observed behavior
- Authenticates to Ghost CMS using one of several methods: password, API key, invite flow, session secret, or cookie.
modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb:588-632 - Optionally exploits CVE-2026-22594 to bypass 2FA by adding payload withheld to the login request.
modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb:314-318 - Downloads the active theme or uses a local template, then injects a Handlebars SSTI payload that executes an OS command via child_process.exec.
modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb:218-233 - Uploads the malicious theme, activates it, and triggers the payload by requesting a tag, page, or author route that renders the injected template.
modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb:683-710 - Cleans up by reverting to the original theme, deleting the malicious theme, and removing created content and accounts.
modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb:654-681
Behaviors behind the backdoor verdict
Observables
- Payload Execution
- Payload withheldThe module constructs a JavaScript payload that executes the attacker-supplied command via child_process.exec. This is the core RCE mechanism for the exploit.
modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb:227-228 - Authentication Bypass
- Payload withheldThe module conditionally sets skipEmailVerification to bypass 2FA for vulnerable versions, matching CVE-2026-22594.
modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb:314-317 - Cleanup Routine
- Payload withheldThe module includes a cleanup method that attempts to restore the original theme and remove artifacts created during exploitation, which is normal for a Metasploit module.
modules/exploits/multi/http/ghostcms_auth_rce_cve_2026_29053.rb:654-681
What the analysis did not establish
- Analysis is based on the module source code only; Metasploit framework mixins, libraries, and external payloads are not expanded.
- The artifact was not executed; classification is based on static analysis of the provided Ruby source.
- Only the module source file was reviewed; Metasploit framework mixins, libraries, and external payloads are not included in the evidence.
- The actual payload.encoded content is not expanded; the module uses the standard Metasploit payload mechanism.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitWordPress Unauthenticated RCE via Pix for WooCommerce plugin
Metasploit exploitby Alexis LafontaineAdded to Metasploit 2026-07-19ExploitCVE-2026-38911 file
Analysis
Technical assessment
A Metasploit module that exploits an unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin (CVE-2026-3891) to achieve remote code execution by uploading a PHP payload and triggering it.
Backdoor review
No backdoor observed in reviewed code
The Metasploit module source code implements a standard exploit for CVE-2026-3891, an unauthenticated arbitrary file upload vulnerability in the Pix for WooCommerce WordPress plugin. The module retrieves a nonce, uploads a PHP payload via a multipart POST request, and triggers the payload. No backdoor, deceptive payload, or concealed operator-directed harm is present. The module's behavior is consistent with its documented purpose.
Classification basis and observed behavior
Classification basis
The module's exploit method orchestrates file upload and execution to achieve remote code execution, which is the definition of an exploit. The source code includes functions to upload a payload and trigger it, and the metadata describes it as an exploit module.
modules/exploits/multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891.rb:121-124modules/exploits/multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891.rb:6modules/exploits/multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891.rb:18-24Requirements
- Target must be running a vulnerable version of the Pix for WooCommerce plugin (<= 1.5.0).
modules/exploits/multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891.rb:23 - The WordPress site must have the admin-ajax.php endpoint accessible.
modules/exploits/multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891.rb:71
Observed behavior
- Retrieves an AJAX nonce by sending a POST request to admin-ajax.php with action 'lkn_pix_for_woocommerce_generate_nonce'.
modules/exploits/multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891.rb:66-88 - Uploads a PHP payload file via a multipart POST request to admin-ajax.php, using the action 'lkn_pix_for_woocommerce_c6_save_settings' and the retrieved nonce.
modules/exploits/multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891.rb:90-112 - Triggers the uploaded PHP payload by sending a GET request to the predicted file path under wp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/.
modules/exploits/multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891.rb:114-124
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe module performs a nonce retrieval, file upload, and payload trigger, which matches the described vulnerability and is typical for a Metasploit exploit. No unrelated or concealed actions are observed.
modules/exploits/multi/http/wp_plugin_pix_unauth_rce_cve_2026_3891.rb:66-124
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; framework mixins, libraries, and external payloads are not included.
- The evidence does not include runtime behavior, target interaction, or verification of exploit success.
- Only the module source code and metadata are reviewed; Metasploit framework mixins, libraries, and external payloads are not expanded or analyzed.
- The review does not verify the correctness or safety of the exploit against a live target.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitAuthenticated RCE in Splunk (splunk_archiver app)
Metasploit exploitby Alex Hordijk, plus 1 additional contributorAdded to Metasploit 2025-12-12ExploitCVE-2024-369851 file
Analysis
Technical assessment
A Metasploit module that exploits CVE-2024-36985, an authenticated remote code execution vulnerability in Splunk Enterprise via the splunk_archiver application. It uses the 'copybuckets' lookup to execute the 'sudobash' helper script with attacker-controlled arguments, delivering a payload.
Backdoor review
No backdoor observed in reviewed code
The supplied Metasploit module source code implements a straightforward authenticated RCE exploit for CVE-2024-36985. It uses standard Metasploit HTTP and Splunk mixins, constructs a JSON payload to abuse the 'copybuckets' lookup, and executes the attacker-supplied payload via the 'sudobash' script. No hidden, deceptive, or unrelated backdoor behavior is present; all actions are consistent with the stated exploit purpose.
Classification basis and observed behavior
Classification basis
The module is a complete Metasploit exploit that authenticates, checks version, and sends crafted queries to achieve remote code execution by invoking the sudobash script with attacker-controlled arguments. It includes an exploit method that delivers a payload.
modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb:6modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb:135-147Requirements
- Valid Splunk credentials with admin role
modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb:64-65 - Target must be a vulnerable Splunk version (< 9.0.10, 9.1.0-9.1.4, 9.2.0-9.2.1) with splunk_archiver app enabled
modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb:76-84 - The 'sudobash' helper script must exist on the target filesystem (optionally created by the module)
modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb:67modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb:114-124
Observed behavior
- Authenticates to Splunk using provided username and password
modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb:74modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb:137 - Checks Splunk version and splunk_archiver app status to confirm exploitability
modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb:75-84 - Optionally creates the 'sudobash' script by sending an 'archivebuckets forcerun=1' query
modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb:114-124 - Constructs a JSON payload that specifies the path to 'sudobash' and attacker-controlled arguments, then triggers execution via a 'copybuckets' query
modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb:97-112modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb:126-133
Behaviors behind the backdoor verdict
Observables
- Exploit Mechanism
- Payload withheldThis is the core exploit logic, consistent with the CVE description and module metadata.
modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb:97-112modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb:126-133 - Authentication
- Payload withheldThe module is explicitly post-auth, matching the CVE requirement for a low-privileged user.
modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb:64-65 - Payload Execution
- Payload withheldThe payload is passed through an environment variable and executed; this is the intended RCE delivery.
modules/exploits/linux/http/splunk_auth_rce_cve_2024_36985.rb:106-108
What the analysis did not establish
- Only the module source and metadata are provided; Metasploit framework mixins, libraries, and external payloads are not expanded.
- The evidence does not include the actual execution or verification of the exploit.
- Only the module source file was reviewed; Metasploit framework mixins (Msf::Exploit::Remote::HttpClient, Msf::Exploit::Remote::HTTP::Splunk) and the payload itself are not expanded or inspected.
- The review does not verify the correctness or safety of the exploit against a live target.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitAuthenticated RCE in Splunk (SimpleXML dashboard PDF generation)
Metasploit exploitby Danylo Dmytriiev, plus 1 additional contributorAdded to Metasploit 2025-12-12ExploitCVE-2022-435711 file
Analysis
Technical assessment
This is a Metasploit module that exploits CVE-2022-43571, an authenticated remote code execution vulnerability in Splunk Enterprise. It injects a Python payload into a SimpleXML dashboard's style parameter and triggers execution via the PDF export function.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a standard authenticated RCE exploit for CVE-2022-43571. It injects a user-supplied payload into a Splunk dashboard template and triggers execution via PDF export. No concealed backdoor, unrelated remote access, persistence, credential theft, or deceptive behavior was observed. The module uses the framework's standard payload delivery mechanism and includes cleanup logic to remove the created dashboard.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module. It includes code to authenticate, inject a payload, trigger its execution, and establish a session. The module type is 'exploit', and the description states it 'exploits a Remote Code Execution (RCE) vulnerability'.
modules/exploits/multi/http/splunk_auth_rce_cve_2022_43571.rb:6modules/exploits/multi/http/splunk_auth_rce_cve_2022_43571.rb:19modules/exploits/multi/http/splunk_auth_rce_cve_2022_43571.rb:146-162Requirements
- Valid credentials for a Splunk user with admin role are required.
modules/exploits/multi/http/splunk_auth_rce_cve_2022_43571.rb:60 - The target Splunk version must be vulnerable (8.1.0-8.1.11, 8.2.0-8.2.8, or 9.0.0-9.0.1).
modules/exploits/multi/http/splunk_auth_rce_cve_2022_43571.rb:135-137
Observed behavior
- The module authenticates to Splunk using the provided username and password.
modules/exploits/multi/http/splunk_auth_rce_cve_2022_43571.rb:133modules/exploits/multi/http/splunk_auth_rce_cve_2022_43571.rb:148 - It constructs a malicious SimpleXML dashboard containing a Python payload injected into a sparkline style parameter (lineColor or fillColor).
modules/exploits/multi/http/splunk_auth_rce_cve_2022_43571.rb:97-123 - The dashboard is created on the target Splunk instance and then exported as a PDF, which triggers execution of the injected Python code.
modules/exploits/multi/http/splunk_auth_rce_cve_2022_43571.rb:156-158 - The module attempts to clean up by deleting the created dashboard after exploitation.
modules/exploits/multi/http/splunk_auth_rce_cve_2022_43571.rb:125-127
Behaviors behind the backdoor verdict
Observables
- Payload Injection
- Payload withheldThis is the core exploit mechanism: injecting attacker-controlled code into a style parameter to achieve RCE, consistent with the described vulnerability.
modules/exploits/multi/http/splunk_auth_rce_cve_2022_43571.rb:97-123modules/exploits/multi/http/splunk_auth_rce_cve_2022_43571.rb:146-162 - Cleanup Behavior
- Payload withheldThe module attempts to remove the dashboard it created, which is normal operational security for an exploit module and not indicative of a backdoor.
modules/exploits/multi/http/splunk_auth_rce_cve_2022_43571.rb:125-130
What the analysis did not establish
- Analysis is based on the module source code and metadata only; framework mixins, libraries, and external payloads are not expanded.
- The artifact's behavior is inferred from static code analysis; the code was not executed.
- Review is limited to the module source file; Metasploit framework mixins (e.g., Msf::Exploit::Remote::HTTP::Splunk) and the actual payload (payload.encoded) are not included in the evidence.
- Binary files were not inspected per the evidence envelope policy.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitUnauthenticated RCE in React Server Components (React2Shell)
Metasploit exploitby Lachlan Davidson, plus 2 additional contributorsAdded to Metasploit 2025-12-09ExploitCVE-2025-55182CVE-2025-664781 file
Analysis
Technical assessment
A Metasploit exploit module that achieves unauthenticated remote code execution (RCE) in React Server Components by sending crafted multipart requests to exploit prototype pollution during deserialization (CVE-2025-55182). It supports Next.js and Waku frameworks on Unix and Windows targets.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a public exploit for CVE-2025-55182 (React2Shell). It constructs and sends HTTP requests to achieve remote code execution on vulnerable React Server Components endpoints. No concealed backdoor, deceptive payload, or operator-directed harm beyond the stated exploit behavior was observed.
Classification basis and observed behavior
Classification basis
The module is a complete Metasploit exploit that constructs and sends malicious HTTP requests to achieve remote code execution. It includes an 'exploit' method that executes a payload via child_process.exec, and is classified as an exploit module in its metadata.
modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:6modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:182-184modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:1Requirements
- Target must be running a vulnerable version of React Server Components (19.0.0, 19.1.0, 19.1.1, 19.2.0) with an exposed Server Function endpoint.
modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:37-40
Observed behavior
- Sends a POST request with a multipart/form-data body containing a malicious JSON chunk that uses '__proto__', 'constructor', or 'prototype' as module names to trigger prototype pollution during RSC payload deserialization.
modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:188-201modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:203-221 - Executes an arbitrary command payload on the target server by invoking child_process.exec with the attacker-supplied command.
modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:182-184 - Performs a vulnerability check for Next.js by sending a payload that triggers a redirect with a random ID, and for Waku by detecting framework markers in the response body.
modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:156-163modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:166-178
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the documented exploit behavior for CVE-2025-55182. The module uses the Metasploit payload framework to deliver a command payload.
modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:184 - Payload Execution
- Payload withheldStandard Metasploit exploit pattern: the module executes the user-selected payload on the target. No additional hidden commands are injected.
modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:184 - Check Method
- Payload withheldCheck methods are non-destructive and only verify vulnerability presence. No backdoor behavior.
modules/exploits/multi/http/react2shell_unauth_rce_cve_2025_55182.rb:156-179
What the analysis did not establish
- Analysis is based on module source code and metadata only; Metasploit framework mixins, libraries, and external payloads are not included.
- The code was not executed; classification is based on static analysis of the artifact's intended purpose.
- Only the module source file was reviewed; Metasploit framework mixins, libraries, and external payloads are not expanded and were not analyzed.
- Binary files were not present in the evidence.
- The review does not assess the safety or reliability of the module or its payloads.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitRemote Code Execution Vulnerability in Vvveb
Metasploit exploitby Hamed KohiAdded to Metasploit 2025-10-19ExploitCVE-2025-85181 file
Analysis
Technical assessment
A Metasploit exploit module that authenticates to Vvveb CMS, identifies the active theme, overwrites its theme.php file with attacker-controlled PHP code via the Code Editor's save functionality, and then triggers execution of that code to achieve remote code execution.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a standard authenticated remote code execution exploit for CVE-2025-8518 in Vvveb CMS. It performs login, identifies the active theme, reads the theme file, replaces its content with a Metasploit payload, triggers execution, and restores the original content during cleanup. No concealed, deceptive, or operator-directed harmful behavior beyond the declared exploit functionality was observed.
Classification basis and observed behavior
Classification basis
The module's exploit method orchestrates authentication, file overwrite with a payload, and payload execution, which constitutes active exploitation of the vulnerability. The module type is 'exploit' and it is designed to deliver a payload for remote code execution.
modules/exploits/multi/http/vvveb_auth_rce_cve_2025_8518.rb:240-246Requirements
- Valid credentials for a Vvveb CMS user with access to the Code Editor.
modules/exploits/multi/http/vvveb_auth_rce_cve_2025_8518.rb:61-63 - The target must be running a vulnerable version of Vvveb CMS (up to 1.0.5).
modules/exploits/multi/http/vvveb_auth_rce_cve_2025_8518.rb:24
Observed behavior
- Authenticates to the Vvveb CMS admin panel using provided credentials and a fetched CSRF token.
modules/exploits/multi/http/vvveb_auth_rce_cve_2025_8518.rb:90-123 - Identifies the active theme by parsing the theme management page and extracts the path to its theme.php file.
modules/exploits/multi/http/vvveb_auth_rce_cve_2025_8518.rb:125-147 - Reads the current content of the active theme's theme.php file via the Code Editor's loadFile action.
modules/exploits/multi/http/vvveb_auth_rce_cve_2025_8518.rb:149-164 - Overwrites the theme.php file with the Metasploit payload (PHP code) using the Code Editor's save action.
modules/exploits/multi/http/vvveb_auth_rce_cve_2025_8518.rb:166-185 - Triggers execution of the injected payload by requesting a page that includes the modified theme file.
modules/exploits/multi/http/vvveb_auth_rce_cve_2025_8518.rb:187-199 - Restores the original theme.php content during cleanup to remove artifacts.
modules/exploits/multi/http/vvveb_auth_rce_cve_2025_8518.rb:230-238
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe module logs into Vvveb CMS, locates the active theme's theme.php, replaces its content with a Metasploit payload, and triggers execution by requesting the editor module. This matches the declared CVE-2025-8518 exploit behavior.
modules/exploits/multi/http/vvveb_auth_rce_cve_2025_8518.rb:240-246 - Cleanup Behavior
- Payload withheldThe cleanup method restores the original theme file content, which is standard practice for reducing artifacts on disk and aligns with the declared SideEffects note.
modules/exploits/multi/http/vvveb_auth_rce_cve_2025_8518.rb:230-238
What the analysis did not establish
- Analysis is based solely on the provided Metasploit module source code and metadata; framework mixins, libraries, and external payloads were not expanded or analyzed.
- The module was not executed, and its behavior is inferred from static source code analysis.
- Review covers only the module source file; Metasploit framework mixins (e.g., HttpClient, AutoCheck) and the final payload.encoded content are not expanded or inspected.
- Binary files were not present in the evidence; the binary_policy is FLAGGED_METADATA_ONLY_NOT_ANALYZED, but no binary files were supplied.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitRemote Code Execution Vulnerability in MotionEye Frontend (CVE-2025-60787)
Metasploit exploitby prabhatverma47Added to Metasploit 2025-10-09ExploitCVE-2025-607871 file
Analysis
Technical assessment
A Metasploit module that exploits an OS command injection vulnerability (CVE-2025-60787) in MotionEye Frontend. It authenticates as an admin, adds a malicious camera, injects a payload into the 'image_file_name' configuration parameter, and triggers execution by requesting a snapshot.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a standard authenticated remote code execution exploit for CVE-2025-60787 in MotionEye Frontend. It uses the framework's payload mechanism to inject an OS command via the 'image_file_name' configuration parameter. No concealed backdoor, deceptive payload, or operator-directed harm beyond the declared exploit behavior was observed.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module. It includes code to authenticate, inject a payload into a vulnerable parameter, and trigger remote code execution. The module's type is 'exploit', and its description states it 'exploits a template injection vulnerability'.
modules/exploits/linux/http/motioneye_auth_rce_cve_2025_60787.rb:6modules/exploits/linux/http/motioneye_auth_rce_cve_2025_60787.rb:18modules/exploits/linux/http/motioneye_auth_rce_cve_2025_60787.rb:265modules/exploits/linux/http/motioneye_auth_rce_cve_2025_60787.rb:372-376Requirements
- Valid admin credentials (USERNAME and PASSWORD) for the target MotionEye instance.
modules/exploits/linux/http/motioneye_auth_rce_cve_2025_60787.rb:70-72 - Target must be running a vulnerable version of MotionEye Frontend (0.43.1b4 and prior).
modules/exploits/linux/http/motioneye_auth_rce_cve_2025_60787.rb:20
Observed behavior
- Authenticates to the MotionEye web interface using signed requests.
modules/exploits/linux/http/motioneye_auth_rce_cve_2025_60787.rb:139-175 - Adds a new camera via a POST request to /config/add/.
modules/exploits/linux/http/motioneye_auth_rce_cve_2025_60787.rb:177-210 - Sets the camera configuration, injecting the payload into the 'image_file_name' parameter as a shell command substitution.
modules/exploits/linux/http/motioneye_auth_rce_cve_2025_60787.rb:212-310 - Triggers the exploit by requesting a snapshot for the camera, causing the injected command to execute.
modules/exploits/linux/http/motioneye_auth_rce_cve_2025_60787.rb:312-327 - Cleans up by removing the added camera.
modules/exploits/linux/http/motioneye_auth_rce_cve_2025_60787.rb:329-344
Behaviors behind the backdoor verdict
Observables
- Payload Injection
- Payload withheldThe module injects the Metasploit payload into the image_file_name configuration parameter, which is the declared exploit vector for CVE-2025-60787.
modules/exploits/linux/http/motioneye_auth_rce_cve_2025_60787.rb:265 - Authentication Requirement
- Payload withheldThe module requires valid admin credentials to authenticate to the MotionEye web interface, consistent with the CVE description of 'remote authenticated attackers with admin access'.
modules/exploits/linux/http/motioneye_auth_rce_cve_2025_60787.rb:70-71 - Request Signing
- Payload withheldThe module implements request signing as required by the MotionEye API, using the provided password as the signing key. This is necessary for the exploit to function against the target.
modules/exploits/linux/http/motioneye_auth_rce_cve_2025_60787.rb:98-131
What the analysis did not establish
- Analysis is based solely on the provided Metasploit module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The artifact's behavior is inferred from static code analysis; the code was not executed, and its effectiveness or safety is not verified.
- Review is limited to the provided module source code and metadata. Framework mixins, libraries, and external payloads referenced by the module are not included in the evidence and were not analyzed.
- The actual behavior of the payload.encoded content is not defined in this evidence; it is supplied by the Metasploit framework at runtime and is outside the review scope.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
MetasploitRemote Code Execution Vulnerability in XWiki Platform (CVE-2025-24893)
Metasploit exploitby John KwakAdded to Metasploit 2025-08-23ExploitCVE-2025-248931 file
Analysis
Technical assessment
A Metasploit module that exploits CVE-2025-24893, a template injection vulnerability in XWiki Platform's SolrSearch macro, to achieve unauthenticated remote code execution by injecting a Groovy payload that executes system commands.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a standard remote code execution exploit for CVE-2025-24893. It sends a crafted HTTP GET request containing a Groovy template injection payload to the vulnerable SolrSearch endpoint. The payload executes the user-supplied Metasploit payload (e.g., a reverse shell) via `[cmd_array].execute().text`. No concealed, deceptive, or operator-directed harmful behavior beyond the declared exploit functionality was observed.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module that actively exercises the vulnerability by sending a crafted HTTP request containing a Groovy payload to execute arbitrary system commands on the target. The module includes an exploit method that builds and delivers the payload, which is the defining characteristic of an exploit.
modules/exploits/multi/http/xwiki_unauth_rce_cve_2025_24893.rb:142-145modules/exploits/multi/http/xwiki_unauth_rce_cve_2025_24893.rb:124Requirements
- Target must be running a vulnerable version of XWiki Platform (>= 5.3-milestone-2 and < 15.10.11, or >= 16.0.0-rc-1 and < 16.4.1).
modules/exploits/multi/http/xwiki_unauth_rce_cve_2025_24893.rb:22 - The SolrSearch macro endpoint (/xwiki/bin/get/Main/SolrSearch) must be accessible.
modules/exploits/multi/http/xwiki_unauth_rce_cve_2025_24893.rb:136
Observed behavior
- Sends a GET request to /xwiki/bin/view/Main/ to extract the XWiki version from the HTML element with id 'xwikiplatformversion'.
modules/exploits/multi/http/xwiki_unauth_rce_cve_2025_24893.rb:87-93 - Constructs a command execution payload by wrapping the Metasploit payload in a Groovy expression: {{async async=false}}{{groovy}}['sh', '-c', '<payload>'].execute().text{{/groovy}}{{/async}} for Unix or the equivalent for Windows.
modules/exploits/multi/http/xwiki_unauth_rce_cve_2025_24893.rb:113-125 - Sends the constructed command as the 'text' parameter in a GET request to /xwiki/bin/get/Main/SolrSearch?media=rss, triggering the template injection and executing the system command.
modules/exploits/multi/http/xwiki_unauth_rce_cve_2025_24893.rb:127-140
Behaviors behind the backdoor verdict
Observables
- Exploit Payload Construction
- Payload withheldThe module constructs a Groovy template injection string that executes the attacker-chosen command. This is the expected exploit mechanism for CVE-2025-24893.
modules/exploits/multi/http/xwiki_unauth_rce_cve_2025_24893.rb:124 - Exploit Request
- Payload withheldThe module sends the exploit payload via a GET request to the vulnerable SolrSearch endpoint, matching the publicly documented vulnerability reproduction steps.
modules/exploits/multi/http/xwiki_unauth_rce_cve_2025_24893.rb:130-139
What the analysis did not establish
- Analysis is based solely on the module source code and metadata; the Metasploit framework mixins, libraries, and external payloads referenced by the module are not included in the evidence.
- The module's actual runtime behavior, success rate, and safety cannot be verified from the static source code alone.
- Only the module source code and metadata were reviewed; Metasploit framework mixins, libraries, and external payloads are not expanded and were not analyzed.
- The review does not assess the safety or reliability of the exploit or the Metasploit framework itself.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.