TranDongA3
Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
GitHubTranDongA3/POC-CVE-2025-1094
Repository PoCStars: 0Created 2026-05-10ExploitCVE-2025-10947 files
Analysis
Technical assessment
The artifact is an exploit for CVE-2025-1094, a SQL injection vulnerability in PostgreSQL libpq and psql. It includes a Python script (exolit.py) that sends a crafted payload to a vulnerable Flask web application (app/app.py) to achieve remote code execution via psql meta-commands.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept (PoC) for CVE-2025-1094, demonstrating SQL injection and remote code execution via psql meta-commands. All code and documentation directly support this stated purpose. No concealed, deceptive, or unrelated harmful behavior was observed.
Classification basis and observed behavior
Classification basis
The artifact contains a functional exploit script (exolit.py) that actively sends a malicious payload to a vulnerable application to achieve remote code execution, which is the defining characteristic of an exploit.
exolit.py:1-37README.md:3Requirements
- A target running the vulnerable Flask application (app/app.py) with PostgreSQL and psql accessible.
app/app.py:1-106 - The target must be using a vulnerable version of PostgreSQL libpq (before 17.3, 16.7, 15.11, 14.16, 13.19).
README.md:19
Observed behavior
- Sends an HTTP POST request to the /search endpoint with a payload containing an invalid UTF-8 byte (0xC0) and psql meta-commands.
exolit.py:8exolit.py:14 - The payload bypasses PQescapeLiteral() escaping due to the invalid multibyte sequence, allowing a single quote to terminate the SQL string context.
README.md:29-31app/app.py:32 - The injected psql meta-command \! id executes the 'id' shell command on the server, and the script checks for 'uid=' in the response to confirm successful exploitation.
exolit.py:8exolit.py:20-21
Behaviors behind the backdoor verdict
Observables
- Exploit Payload
- Payload withheldThe PoC payload uses an invalid UTF-8 byte (0xC0) to bypass PQescapeLiteral and inject psql meta-commands for command execution, consistent with the described CVE.
exolit.py:8README.md:70 - Vulnerable Code Pattern
- Payload withheldThe Flask application passes user-controlled input to psql via a subprocess pipe, enabling the meta-command injection demonstrated by the PoC.
app/app.py:86-92 - Command Execution
- Payload withheldThe exploit script sends psql meta-commands to execute 'id' and 'ls /tmp' on the target server, which is the intended demonstration of RCE.
exolit.py:8
What the analysis did not establish
- The evidence includes only the text content of 4 out of 7 files; 3 files (likely Dockerfile, docker-compose.yml, and possibly another) are omitted, so the full build and deployment context is not available.
- The analysis is based solely on static review of the provided source code; the exploit was not executed, and its effectiveness against a live target is not verified.
- Three files (docker-compose.yml, app/Dockerfile, and one other) were omitted from the text evidence; their metadata was reported but content was not analyzed. These files are typical infrastructure files and are unlikely to contain backdoor behavior, but their absence is noted.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubTranDongA3/Simulation_CVE-2024-46256
Repository PoCStars: 0Created 2025-10-29WriteupCVE-2024-4625612 files
Analysis
Technical assessment
A detailed technical writeup in Vietnamese describing the analysis and exploitation of CVE-2024-46256 and CVE-2024-46257, OS command injection vulnerabilities in Nginx Proxy Manager v2.11.3. The document includes code review, payload examples, and screenshots of a simulated attack, but does not contain executable exploit or scanner code.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README and a detailed PoC write-up (POC.md) describing CVE-2024-46256/CVE-2024-46257, which are authenticated OS command injection vulnerabilities in Nginx Proxy Manager. The text documents the vulnerability, provides example payloads (whoami, Python reverse shell), and shows screenshots of exploitation results. No concealed executable behavior, persistence mechanisms, credential theft, or unrelated payloads are present. The artifact is a documentation-only repository with no executable code or instructions that would harm the person reviewing the PoC.
Classification basis and observed behavior
Classification basis
The artifact is a detailed technical analysis and simulation narrative. It contains payload examples and describes exploitation steps, but the primary content is explanatory text and screenshots. It does not provide a standalone, executable script to exploit or scan for the vulnerability; it is a writeup.
POC.md:1README.md:1-5Requirements
- Attacker must have authenticated access to the Nginx Proxy Manager instance.
POC.md:5 - Target must be running Nginx Proxy Manager version 2.11.3.
POC.md:12
Observed behavior
- The writeup describes injecting a command via the 'certificate.domain_names' parameter to execute 'whoami', with the output 'root' observed in Docker debug logs.
POC.md:64POC.md:73-75POC.md:85-87 - The writeup describes a reverse shell payload using Python, connecting to an ngrok address, and claims successful root access.
POC.md:92-94POC.md:96-98
Behaviors behind the backdoor verdict
Observables
- Payload
- Payload withheldExample command injection payload used to demonstrate RCE against the target application (Nginx Proxy Manager), not against the reviewer.
POC.md:74 - Payload
- Payload withheldExample reverse shell payload targeting the vulnerable Nginx Proxy Manager instance, not the reviewer's system.
POC.md:93
What the analysis did not establish
- The evidence packet contains only the text of POC.md and README.md. Ten non-text media files (screenshots) are present but not analyzed, so the visual evidence of exploitation cannot be verified.
- The artifact does not include any executable code; the payloads are presented as inline text examples within the writeup.
- 10 non-text media files (screenshots in static/) were not inspected; they are flagged as metadata-only and could theoretically contain steganographic or malicious content, though the text gives no indication of this.
- The review is limited to the supplied evidence packets; no external verification of the repository or its history was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.