XploitGh0st
Source-scoped identity with 2 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
GitHubXploitGh0st/CVE-2025-48932---exploit
Repository PoCStars: 2Created 2025-11-14ExploitCVE-2025-4893223 files
Analysis
Technical assessment
A Python-based exploit for CVE-2025-48932, a SQL injection vulnerability in Invision Community <= 4.7.20. The code extracts an admin email via boolean-based blind SQL injection, then uses a manually triggered password reset to extract a validation key and reset the admin password, achieving account takeover.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a README, a Python exploit script, and a requirements file for CVE-2025-48932. The script performs a documented SQL injection and password reset workflow against Invision Community. No concealed executable behavior, unrelated payload, persistence mechanism, or operator-directed harm beyond the stated exploit was observed.
Classification basis and observed behavior
Classification basis
The primary artifact is a Python script that actively exploits a SQL injection vulnerability to extract data and reset an admin password, achieving account takeover. The README describes it as a 'proof-of-concept exploit' and the code implements the full exploitation chain.
README.md:7invision-sqli-exploit.py:2-4invision-sqli-exploit.py:180-268Requirements
- Target must be running Invision Community <= 4.7.20 with the Calendar application installed and GeoLocation feature configured.
README.md:34README.md:44-45 - Attacker must manually initiate a password reset for the extracted admin email.
invision-sqli-exploit.py:203-210
Observed behavior
- Fetches a CSRF token from the target's main page.
invision-sqli-exploit.py:83-109 - Performs boolean-based blind SQL injection via the 'location' parameter to extract data character by character using binary search.
invision-sqli-exploit.py:111-178 - Extracts the admin email from the 'core_members' table.
invision-sqli-exploit.py:194-195 - Extracts a password reset validation key from the 'core_validating' table after a manual reset request.
invision-sqli-exploit.py:213-216 - Resets the admin password by sending a POST request with the extracted validation key.
invision-sqli-exploit.py:225-268
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe script's behavior matches the described vulnerability and exploit steps in the README. It extracts data from the target database and resets the admin password, which is the intended PoC demonstration.
invision-sqli-exploit.py:111-178invision-sqli-exploit.py:180-268 - Network Behavior
- Payload withheldThis is a common practice in PoC scripts for ease of testing but reduces security. It does not indicate a backdoor.
invision-sqli-exploit.py:44-48 - User Interaction
- Payload withheldThe script prompts the user to manually trigger a password reset and requires a 'yes' response to a disclaimer. This is consistent with a guided PoC and does not indicate autonomous malicious behavior.
invision-sqli-exploit.py:203-210invision-sqli-exploit.py:314-320
What the analysis did not establish
- Only 3 of 23 files in the repository were provided as text evidence; the remaining 20 files were omitted.
- The CVE record for CVE-2025-48932 was absent from the acquired CVEList V5 dataset, so the vulnerability details could not be independently verified against the official record.
- 20 files in the repository were omitted from the text evidence due to size constraints; their content was not reviewed.
- Binary files were not present, but any non-text content in omitted files could not be assessed.
- The review is limited to static analysis of the provided source code; runtime behavior was not observed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubXploitGh0st/CVE-2025-26794-exploit
Repository PoCStars: 0Created 2025-10-31ExploitCVE-2025-267943 files
Analysis
Technical assessment
A Python-based exploit tool for CVE-2025-26794 that performs time-based blind SQL injection against Exim 4.98 via the ETRN command. It extracts database tables, columns, and data using binary search, and includes an interactive SQL query mode.
Backdoor review
No backdoor observed in reviewed code
The repository contains a proof-of-concept exploit for CVE-2025-26794, an SQL injection vulnerability in Exim 4.98. The Python script (exploit.py) implements time-based blind SQL injection against a remote SMTP server using the ETRN command. All code is consistent with the stated purpose of authorized penetration testing and data extraction. No concealed executable behavior, persistence mechanisms, credential theft, or unrelated payloads were observed. The script uses only standard library modules and performs no network activity beyond connecting to the user-supplied target.
Classification basis and observed behavior
Classification basis
The artifact contains functional Python code that actively exploits CVE-2025-26794 by sending malicious SQL injection payloads to extract data from a target Exim server. It is not limited to detection or scanning; it performs data extraction and includes an interactive query mode.
exploit.py:88-91exploit.py:110-149exploit.py:239-264Requirements
- Target must be running Exim 4.98 with SQLite DBM storage and ETRN serialization enabled.
README.md:24-27 - Network access to the target SMTP service (default port 25).
README.md:38-39
Observed behavior
- Establishes an SMTP connection and sends a normal ETRN command to measure baseline response time.
exploit.py:81-83 - Sends a crafted ETRN command containing a time-delay SQL injection payload to confirm vulnerability.
exploit.py:88-91 - Extracts database table names by querying sqlite_master via time-based blind SQL injection.
exploit.py:184-188 - Extracts column names using pragma_table_info and extracts data from tables using binary search over ASCII values.
exploit.py:206-209exploit.py:110-149 - Provides an interactive mode for executing arbitrary SQLite queries and extracting results.
exploit.py:239-264
Behaviors behind the backdoor verdict
Observables
- Network Connection
- Payload withheldThe script connects to a user-supplied SMTP target to deliver SQL injection payloads, consistent with the stated exploit behavior.
exploit.py:53 - Sql Injection Payload
- Payload withheldThe core exploit payload uses a time-delay technique to perform blind SQL injection, matching the described vulnerability.
exploit.py:89exploit.py:46 - Authorization Prompt
- Payload withheldThe script includes a runtime authorization check before proceeding, reinforcing the stated educational and authorized-testing purpose.
exploit.py:365-368
What the analysis did not establish
- Evidence does not include execution output or verification that the exploit works against a live target.
- The artifact's README.md contains a badge stating 'Status: PoC' but the code implements full data extraction, not just proof of concept.
- No binary files were present in the repository; the review covers only the three text files (README.md, exploit.py, requirements.txt).
- The review does not assess whether the exploit is functional or effective against a real target.
- The artifact's author identity (XploitGh0st) and repository name are noted but not treated as evidence of backdoor behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.