Tagoletta

GitHub · Repository owner · Source ID 17923219
Source profile

Source-scoped identity with 5 associated PoCs and 5 linked vulnerabilities.

Showing 5 PoCs on this page

GitHub

Tagoletta/CVE-2025-69460

Repository PoC0Created 2026-01-21ExploitCVE-2025-694602 files

3.1 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that performs SQL injection login bypass and uploads a PHP web shell to achieve remote code execution on a target Simple Image Gallery application.

Backdoor review

No backdoor observed in reviewed code

The repository contains a single Python script (CVE-2025-69460.py) that automates exploitation of CVE-2025-69460, a known RCE vulnerability in Simple Image Gallery 1.0. The script performs a SQL injection login bypass, uploads a PHP webshell, and prints the shell URL. All actions are consistent with the stated purpose of demonstrating the CVE. No concealed backdoor, unrelated payload, or operator-directed harm was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareSimple Image Gallery
Attack typesSQL InjectionRemote Code ExecutionAuthentication Bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits a SQL injection vulnerability to bypass login, then uploads and deploys a PHP web shell to execute arbitrary commands on the target. This constitutes an exploit, not merely a scanner or writeup.

CVE-2025-69460.py:14CVE-2025-69460.py:20-22CVE-2025-69460.py:52-55

Requirements

  • Target must be running Simple Image Gallery web application.README.md:1

Observed behavior

  • Prompts user for target URL and normalizes it.CVE-2025-69460.py:7-12
  • Defines a PHP web shell payload that executes system commands via 'cmd' GET parameter.CVE-2025-69460.py:14
  • Sends a POST request to /classes/Login.php?f=login with SQL injection payload in username field to bypass authentication.CVE-2025-69460.py:20-22
  • If login bypass succeeds, fetches user profile page to extract user details (id, firstname, lastname, username).CVE-2025-69460.py:36-43
  • Uploads the PHP web shell via a multipart POST request to /classes/Users.php?f=save, embedding the shell as the user's profile image.CVE-2025-69460.py:52-55
  • If upload succeeds, retrieves the shell URL from the user profile page and prints it with a 'cmd=whoami' example.CVE-2025-69460.py:57-62
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell Upload
Payload withheldThe script uploads a PHP file containing a simple command execution webshell (system($_GET['cmd'])) to the target server. This is the expected behavior for a PoC exploiting the stated RCE vulnerability.CVE-2025-69460.py:14CVE-2025-69460.py:50-55
Sql Injection
Payload withheldThe script performs a SQL injection to bypass authentication on the target application. This is a standard technique for exploiting the referenced vulnerability.CVE-2025-69460.py:21-22
Target Interaction
Payload withheldThe script takes a single target URL as input and all subsequent HTTP requests are directed to that target. No external or unrelated network communication is present.CVE-2025-69460.py:7-12
Review boundaries

What the analysis did not establish

  • CVE-2025-69460 record is absent from the acquired CVEList V5 dataset, so official vulnerability details are not available for cross-reference.
  • The README.md references an external writeup and ExploitDB entry, but those resources are not included in the evidence.
  • Review is limited to the supplied text files; no binary or non-text media were present.
  • The script's behavior depends on the target server's response; no dynamic analysis was performed.
  • The CVE record was absent from the acquired CVEList, so the script's alignment with the official CVE description could not be verified.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

Tagoletta/CVE-2025-69459

Repository PoC0Created 2026-01-21ExploitCVE-2025-694592 files

2.5 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that sends HTTP requests to create an admin account on a vulnerable Movie Rating System 1.0 instance and then logs in with the created credentials.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a single Python script (CVE-2025-69459.py) and a README.md file. The Python script is a proof-of-concept exploit for CVE-2025-69459, which creates an admin account on a vulnerable Movie Rating System instance and then logs in. The script performs only the described exploit actions: it sends a POST request to create a user with hardcoded credentials ('tago'/'tagoletta') and then logs in. No backdoor, persistence, credential exfiltration, or unrelated payload behavior is observed. The script does not connect to any external attacker-controlled server, does not download or execute additional code, and does not modify the local system. The README.md contains only links to a write-up and an Exploit-DB entry. There is no obfuscation, no concealed behavior, and no deceptive functionality.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareMovie Rating System 1.0
Attack typesbroken access controlprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively creates an admin account and logs in, which constitutes exploitation of the broken access control vulnerability rather than mere detection or scanning.

CVE-2025-69459.py:13-24CVE-2025-69459.py:28-39

Requirements

  • Target URL of a Movie Rating System 1.0 instanceCVE-2025-69459.py:4

Observed behavior

  • Sends a multipart/form-data POST request to /payload withheld to create a new admin user with hardcoded credentials (Username: tago, Password: tagoletta)CVE-2025-69459.py:10-24
  • If the account creation succeeds (HTTP 200), sends a second POST request to /payload withheld to authenticate with the newly created credentialsCVE-2025-69459.py:26-39
  • Parses the login response JSON and prints success or failure messagesCVE-2025-69459.py:41-49
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Credentials
Payload withheldThe PoC uses hardcoded credentials to create and authenticate an admin account on the target system. These are part of the exploit's normal operation and are not used for backdoor access to the tester's machine.CVE-2025-69459.py:10-11
Target Url Input
Payload withheldThe script prompts the operator for a target URL, which is the expected behavior for a PoC exploit. No hardcoded attacker-controlled server is present.CVE-2025-69459.py:4
Exploit Endpoint
Payload withheldThe script sends a POST request to this endpoint to create an admin user, consistent with the described CVE.CVE-2025-69459.py:13
Login Endpoint
Payload withheldAfter account creation, the script logs in via this endpoint, which is part of the normal exploit flow.CVE-2025-69459.py:28
Review boundaries

What the analysis did not establish

  • CVE-2025-69459 record is absent from the acquired CVEList V5 dataset; classification relies solely on the repository content.
  • The script's effectiveness or safety has not been verified; analysis is based on static code review only.
  • Only the two text files (CVE-2025-69459.py and README.md) were reviewed; no other files exist in the repository according to the evidence envelope.
  • The CVE record (CVE-2025-69459) was absent from the acquired CVEList V5 dataset, so the official description could not be cross-referenced.
  • The review does not assess the safety of the linked external resources (tagmachan.com, exploit-db.com).
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

Tagoletta/CVE-2025-69458

Repository PoC0Created 2026-01-21ExploitCVE-2025-694582 files

2.1 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2025-69458, an unauthenticated SQL injection vulnerability in Movie Rating System 1.0, to achieve remote code execution by writing a PHP webshell to the target server via INTO OUTFILE.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python script (CVE-2025-69458.py) and a README.md file. The Python script is a proof-of-concept exploit for CVE-2025-69458 that automates SQL injection to achieve remote code execution on a target Movie Rating System 1.0 application. The script takes a target URL as input, performs SQL injection to write a PHP webshell, and then executes a 'whoami' command via the webshell to demonstrate control. The README.md contains only two external links to a write-up and an Exploit-DB entry. No backdoor, deceptive payload, or behavior targeting the person running the PoC is observed. The script's actions are consistent with the stated exploit purpose and do not exhibit any concealed operator-directed harm against the user executing the PoC.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareMovie Rating System 1.0
Attack typesSQL InjectionRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits a SQL injection vulnerability to write a PHP file to the server and then executes a system command on the target, which is the definition of an exploit.

CVE-2025-69458.py:54-56CVE-2025-69458.py:61

Requirements

  • Target URL of a vulnerable Movie Rating System 1.0 instance.CVE-2025-69458.py:6
  • Target must have a writable web directory and MySQL FILE privilege for the database user.CVE-2025-69458.py:54-56

Observed behavior

  • Prompts user for target URL and normalizes it.CVE-2025-69458.py:6-11
  • Crafts a PHP webshell payload that executes system commands via a GET parameter.CVE-2025-69458.py:13
  • Scrapes the target's homepage to find a link to a 'movie' page, then navigates to it to find a SQL injection point.CVE-2025-69458.py:18-34
  • Triggers a SQL error by appending a single quote to extract the server file path of the vulnerable script.CVE-2025-69458.py:41-42
  • Constructs a SQL injection payload using INTO OUTFILE to write the PHP webshell to the discovered directory.CVE-2025-69458.py:54-56
  • Sends the malicious SQL injection request to upload the webshell.CVE-2025-69458.py:59
  • Executes the 'whoami' command on the target via the uploaded webshell and prints the output and shell URL.CVE-2025-69458.py:61-63
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThe script's behavior is consistent with a standard proof-of-concept exploit for CVE-2025-69458. It does not perform any actions against the user running the script.CVE-2025-69458.py:13CVE-2025-69458.py:54-56CVE-2025-69458.py:61
User Input
Payload withheldThe script requires the user to specify the target system. It does not contain any hardcoded or hidden target addresses.CVE-2025-69458.py:6
Payload Generation
Payload withheldThe payload is a simple PHP command execution shell. It is not obfuscated and its purpose is clearly related to the exploit.CVE-2025-69458.py:13
Review boundaries

What the analysis did not establish

  • CVE-2025-69458 record was absent from the acquired CVEList V5 dataset, so CVE details are unverified.
  • The README.md references an external writeup and ExploitDB entry, but their content was not included in the evidence.
  • The review is limited to the supplied text files (CVE-2025-69458.py and README.md). No binary files were present. The analysis does not assess the safety of the external links in README.md or the target application.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

Tagoletta/CVE-2025-69457

Repository PoC0Created 2026-01-21ExploitCVE-2025-694572 files

3.2 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that performs SQL injection to bypass login, then uploads a PHP web shell to achieve remote code execution on a target 'Responsive Tourism Website'.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a single Python script (CVE-2025-69457.py) and a README.md. The script performs a publicly documented SQL injection login bypass and uploads a simple PHP webshell to a target application. The webshell payload is a standard one-liner that executes commands passed via a GET parameter. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit was observed.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespythonphp
Target softwareResponsive Tourism Website
Attack typessql injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits a target by sending a crafted SQL injection payload to bypass login and then uploading a PHP file containing a system command execution shell. This constitutes an exploit as it exercises the vulnerability to achieve remote code execution.

CVE-2025-69457.py:20-21CVE-2025-69457.py:48-50

Requirements

  • Target URL of a vulnerable Responsive Tourism Website 3.1 instance.CVE-2025-69457.py:6

Observed behavior

  • Prompts user for a target URL and normalizes it.CVE-2025-69457.py:6-11
  • Sends a SQL injection payload in the username and password fields to bypass authentication.CVE-2025-69457.py:19-21
  • Fetches an existing user's profile details from the admin panel.CVE-2025-69457.py:25-32
  • Constructs a multipart form-data request containing a PHP web shell and uploads it via the user profile save functionality.CVE-2025-69457.py:46-50
  • Extracts the URL of the uploaded web shell from the response and prints it, allowing the attacker to execute arbitrary system commands.CVE-2025-69457.py:52-57
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell Upload
Payload withheldThe script uploads a PHP file containing a system command execution webshell, which is the stated purpose of the exploit.CVE-2025-69457.py:48-49
Sql Injection
Payload withheldThe script uses SQL injection payloads to bypass authentication, which is part of the exploit chain.CVE-2025-69457.py:20
Review boundaries

What the analysis did not establish

  • The CVE record for CVE-2025-69457 was absent from the acquired CVEList V5 dataset, so the vulnerability description could not be independently verified from that source.
  • The README.md file contains links to an external writeup and an ExploitDB entry, but the content of those external resources was not provided for analysis.
  • Only the provided text files were reviewed; no binary files were present or analyzed.
  • The review does not assess the safety or legality of using this exploit against any system.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHub

Tagoletta/CVE-2023-38890

Repository PoC0Created 2026-01-21ExploitCVE-2023-388902 files

3.5 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2023-38890 in Online Shopping Portal 3.1 by performing SQL injection to bypass login, then uploading a PHP web shell via an authenticated file upload endpoint to achieve remote code execution.

Backdoor review

No backdoor observed in reviewed code

The repository contains a single Python script (CVE-2023-38890.py) that automates exploitation of CVE-2023-38890 against a target Online Shopping Portal 3.1 instance. The script performs SQL injection to bypass login, uploads a PHP web shell via a file upload vulnerability, and prints the shell path. All actions are directed at a user-supplied target URL and are consistent with the documented exploit chain. No concealed backdoor, unrelated payload, credential exfiltration, or persistence mechanism was observed.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareOnline Shopping Portal Project 3.1
Attack typessql injectionunrestricted file uploadremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the vulnerability by sending a crafted SQL injection to bypass authentication, then uses the authenticated session to upload a PHP web shell, which is the definition of exploit code.

CVE-2023-38890.py:13-14CVE-2023-38890.py:26-27

Requirements

  • Target running Online Shopping Portal 3.1 with vulnerable login and file upload endpoints.CVE-2023-38890.py:5

Observed behavior

  • Prompts user for target URL.CVE-2023-38890.py:5
  • Sends SQL injection payload in username field to bypass admin login.CVE-2023-38890.py:12-14
  • Uploads a PHP web shell via multipart form data to insert-product.php, using authenticated session.CVE-2023-38890.py:24-27
  • Extracts the uploaded shell path by searching product listing and prints the full URL.CVE-2023-38890.py:29-33
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Web Shell Upload
Payload withheldThe script uploads a PHP web shell to the target server as part of the exploit chain. This is the intended exploit payload, not a backdoor against the PoC runner.CVE-2023-38890.py:6CVE-2023-38890.py:26
Sql Injection
Payload withheldThe script uses SQL injection in the login form to bypass authentication. This is part of the documented exploit for CVE-2023-38890.CVE-2023-38890.py:13
Target Url Input
Payload withheldThe script prompts the user for a target URL, indicating that all actions are directed at an external target, not the local machine running the PoC.CVE-2023-38890.py:5
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied text files; no runtime behavior or network traffic was observed.
  • The script's success depends on the target application's exact endpoint paths and form field names, which are assumed but not verified.
  • Only the supplied text files were reviewed; no binary or non-text files were present.
  • The review does not assess whether the exploit works as claimed or whether the target application is actually vulnerable.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.