cazzysoci
Source-scoped identity with 2 associated PoCs and 1 linked vulnerability.
Exploit catalog results
Showing 2 PoCs on this page
GitHubcazzysoci/cve-2026-48908
Repository PoCStars: 0Created 2026-07-09ExploitCVE-2026-489083 files
Analysis
Technical assessment
Python script that exploits CVE-2026-48908 in SP Page Builder for Joomla by uploading a crafted ZIP file containing a PHP webshell via the unauthenticated custom icon upload endpoint, then checks for successful shell access.
Backdoor review
No backdoor observed in reviewed code
The PoC script exploits CVE-2026-48908 by uploading a ZIP containing a PHP webshell. The webshell provides file upload functionality on the target, which is the expected exploit behavior. No concealed backdoor, credential theft, persistence, or unrelated payload was observed.
Classification basis and observed behavior
Classification basis
The script actively uploads a PHP webshell to a target server and verifies its execution, which constitutes exploitation rather than mere detection or scanning.
poc.py:75-104Requirements
- Target URL running vulnerable SP Page Builder extension (versions 1.0.0-6.6.1)
poc.py:110-114 - List of target URLs provided as input file
poc.py:139-140
Observed behavior
- Constructs a ZIP archive containing a PHP webshell disguised as an icon font upload
poc.py:31-49 - Sends POST request to the vulnerable upload endpoint without authentication
poc.py:51-58 - Checks if the uploaded PHP shell is accessible and executable by verifying HTTP 200 response containing the marker 'Shinday'
poc.py:60-67 - Writes successfully exploited shell URLs to result.txt
poc.py:128-131
Behaviors behind the backdoor verdict
Observables
- Webshell
- Payload withheldThe PHP payload embedded in the ZIP provides a file upload form on the compromised server. This is the intended exploit outcome for the CVE.
poc.py:32 - Exploit Mechanism
- Payload withheldThe script uploads a crafted ZIP containing a PHP file to the vulnerable endpoint, consistent with the described arbitrary file upload vulnerability.
poc.py:51-58poc.py:110-115
What the analysis did not establish
- Only one text file (poc.py) was provided; two additional files in the repository were omitted from the evidence packet.
- The evidence packet reports complete_artifact_coverage as false, indicating not all repository content was included.
- Two additional files in the repository (total 3 files) were not provided as text and were not analyzed. Their content is unknown, but the PoC script itself shows no backdoor behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubcazzysoci/cve-breeze-2026
Repository PoCStars: 0Created 2026-04-26ExploitUnlinked4 files
Analysis
Technical assessment
A Python script that checks if a WordPress site runs a vulnerable version of the Breeze plugin (CVE-2026-3844) and, if so, attempts to upload a PHP webshell via the plugin's Gravatar upload functionality to achieve remote code execution.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence is a single Python script (breeze.py) that claims to be a PoC exploit for CVE-2026-3844 against the WordPress Breeze plugin. The script checks the target plugin version, then attempts to upload a PHP webshell via a gravatar-related endpoint. The embedded PHP webshell provides standard file manager capabilities (browse, upload, edit, delete, download). The script's behavior is consistent with a straightforward exploit PoC: it does not contain concealed backdoor functionality, credential exfiltration, persistence mechanisms, or unrelated payloads. No obfuscation or deceptive behavior was observed.
Classification basis and observed behavior
Classification basis
The script actively uploads a PHP webshell to a remote target and verifies its accessibility, which constitutes exploitation, not just detection or scanning.
breeze.py:155-222Requirements
- Target must have a vulnerable version of the Breeze plugin installed (<=2.1.19 or <=2.4.4).
breeze.py:34-35 - The target's Breeze plugin must have the Gravatar upload feature enabled and accessible.
breeze.py:155-222
Observed behavior
- Checks the target's Breeze plugin version by fetching readme.txt or breeze.php and parsing the version string.
breeze.py:126-145 - Creates a local PHP webshell file (shell.php) containing file management and command execution capabilities.
breeze.py:38-118breeze.py:160-162 - Attempts to upload the webshell to the target via POST requests to multiple endpoints using the 'breeze_fetch_gravatar' action.
breeze.py:168-201 - Tests if the uploaded webshell is accessible at several predicted URLs and reports success if a 200 response is received.
breeze.py:207-222
Behaviors behind the backdoor verdict
Observables
- Embedded Webshell
- Payload withheldThe script embeds a PHP webshell that is written to a local file and uploaded to the target. The webshell is a standard file manager with no hidden or unrelated functionality.
breeze.py:38-118 - Exploit Behavior
- Payload withheldThe exploit_gravatar_upload function attempts to upload the webshell to several WordPress endpoints, then checks for successful deployment at predictable URLs. This is normal exploit behavior.
breeze.py:155-222
What the analysis did not establish
- Only the main Python script (breeze.py) was provided; 3 other files in the repository were omitted from the evidence.
- The evidence does not include any output or logs confirming successful execution of the exploit.
- Three additional files in the repository were not included in the text evidence; their content is unknown.
- The analysis is limited to static review of the provided text; no dynamic execution or network analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.