amalpvatayam67
Source-scoped identity with 8 associated PoCs and 8 linked vulnerabilities.
Exploit catalog results
Showing 8 PoCs on this page
GitHubamalpvatayam67/day10-nextjs-middleware-lab
Repository PoCStars: 0Created 2025-09-23ExploitCVE-2025-2992716 files
Analysis
Technical assessment
The artifact is a Next.js middleware authorization bypass lab. The exploit.sh script demonstrates sending a crafted x-token header to bypass middleware checks and access the /admin endpoint without valid authentication.
Backdoor review
No backdoor observed in reviewed code
The reviewed text files (Dockerfile, README.md, exploit.sh, package.json) constitute a Next.js middleware authorization bypass lab for CVE-2025-29927. The exploit.sh script demonstrates the vulnerability by sending a crafted header to bypass middleware, which is the expected educational behavior. No concealed executable payload, persistence mechanism, credential theft, or unrelated remote access is present in the supplied text.
Classification basis and observed behavior
Classification basis
The exploit.sh script contains explicit commands to exercise the vulnerability by sending a crafted header to bypass middleware, which is the definition of exploit code.
exploit.sh:17-19Requirements
- Target Next.js application must be running with the vulnerable middleware logic.
exploit.sh:4
Observed behavior
- Sends a curl request with a crafted x-token header to bypass middleware authorization and access the /admin endpoint.
exploit.sh:17-19 - Attempts to access a flag endpoint at /api/flag.
exploit.sh:21-22
Behaviors behind the backdoor verdict
Observables
- Vulnerability Demonstration
- Payload withheldThis is the normal exploit behavior for the stated CVE-2025-29927 lab; it is not a backdoor.
exploit.sh:17-19 - Flag Endpoint
- Payload withheldThe script attempts to reach a flag endpoint as part of the lab exercise; no malicious payload is delivered.
exploit.sh:21-22
What the analysis did not establish
- Only 4 of 16 files in the repository are included in the evidence; the middleware.js file containing the vulnerable logic is not provided.
- The evidence does not include the entrypoint.sh or next.config.js files, which may contain additional context.
- 12 text files from the repository were omitted from the evidence packet; their content was not reviewed.
- No binary files were identified, but any non-text content in the repository would not have been analyzed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubamalpvatayam67/day09-bentoml-deser-lab
Repository PoCStars: 0Created 2025-09-22ExploitCVE-2025-275207 files
Analysis
Technical assessment
The artifact contains a shell script (exploit.sh) that generates a malicious Python pickle payload and sends it to a vulnerable BentoML-style server endpoint to achieve remote code execution.
Backdoor review
No backdoor observed in reviewed code
The repository contains a deliberately vulnerable educational lab for CVE-2025-27520 (BentoML insecure deserialization). The exploit.sh script demonstrates a standard proof-of-concept attack against the lab's own server, using a pickle payload to read a flag file. No concealed backdoor, deceptive payload, or operator-directed harm targeting the person running the PoC was observed.
Classification basis and observed behavior
Classification basis
The exploit.sh script constructs and delivers a malicious serialized object designed to execute arbitrary commands on the target server, which is the definition of an exploit.
exploit.sh:9-25Requirements
- A running instance of the vulnerable BentoML-style server with the /predict endpoint exposed.
exploit.sh:4-5
Observed behavior
- Generates a base64-encoded Python pickle payload that executes 'cat /opt/flag.txt' upon deserialization.
exploit.sh:9-20 - Sends the payload via an HTTP POST request to the /predict endpoint with Content-Type: application/json.
exploit.sh:23-25
Behaviors behind the backdoor verdict
Observables
- Vulnerable Deserialization
- Payload withheldThis is the expected PoC behavior for CVE-2025-27520, demonstrating RCE via insecure deserialization against the lab's own server.
exploit.sh:9-20 - Educational Lab
- Payload withheldConfirms the artifact is a self-contained educational exercise, not a trojanized tool.
README.md:3-4
What the analysis did not establish
- The server-side application code (app.py) that deserializes the payload is not included in the selected text files, so the exact deserialization mechanism cannot be confirmed.
- The evidence packet reports 3 unclassified files and 3 text files without content, indicating the artifact is not fully represented.
- Three text files (app.py, entrypoint.sh, and one other) are present in the repository but were not included in the evidence packet. Their content could not be reviewed.
- Binary files were flagged as metadata-only and not analyzed, though none were identified in the inventory.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubamalpvatayam67/day08-CISCO-fmc-sim
Repository PoCStars: 1Created 2025-09-20ExploitCVE-2025-202656 files
Analysis
Technical assessment
A bash script (exploit.sh) that sends a crafted JSON payload to a simulated Cisco FMC server, causing it to execute an arbitrary shell command. The README explicitly states it demonstrates the impact class of CVE-2025-20265.
Backdoor review
No backdoor observed in reviewed code
The reviewed text files (Dockerfile, README.md, exploit.sh) describe and implement a local educational simulation of a Cisco FMC management-plane RCE. The exploit.sh script sends a user-supplied command to a local server, and the README explicitly states the simulation is for local learning only. No concealed, deceptive, or operator-directed harmful behavior (credential theft, unrelated remote access, persistence) is present in the supplied evidence.
Classification basis and observed behavior
Classification basis
The artifact contains a script (exploit.sh) that actively sends a payload designed to trigger command execution on a target. The README confirms it is a simulation demonstrating the impact of CVE-2025-20265, and the script's behavior is to exploit a command injection vulnerability, not merely detect it.
exploit.sh:1-8README.md:3Requirements
- Target server must be running the simulated FMC service on a reachable network port.
exploit.sh:3-4
Observed behavior
- Constructs a JSON payload containing a shell command prefixed with 'CMD:' and sends it via HTTP POST to the /api/config endpoint.
exploit.sh:5-8 - The default command executed is 'cat /opt/flag.txt', demonstrating arbitrary command execution.
exploit.sh:5
Behaviors behind the backdoor verdict
Observables
- Educational Simulation
- Payload withheldEstablishes the intended benign purpose of the code, consistent with the absence of backdoor behavior.
README.md:3 - Command Execution Mechanism
- Payload withheldThis is the normal exploit behavior against the stated target (a local simulation server). It does not exhibit concealed or unrelated harmful actions.
exploit.sh:5-8
What the analysis did not establish
- The server-side code (server.py) that processes the injected command is not included in the evidence, so the exact mechanism of command execution cannot be confirmed.
- The artifact is a simulation and does not target a real Cisco FMC instance.
- Three text files (server.py, entrypoint.sh, and three unclassified files) are omitted from the supplied evidence; their content is not reviewed.
- The review is limited to static analysis of the provided text excerpts; no dynamic execution or binary analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubamalpvatayam67/day06-foxcms-rce
Repository PoCStars: 0Created 2025-09-18ExploitCVE-2025-293065 files
Analysis
Technical assessment
The artifact is an educational lab that simulates CVE-2025-29306. It includes a bash script (exploit.sh) that sends a crafted serialized payload via an HTTP GET request to a vulnerable PHP endpoint, intending to execute the command 'cat /opt/flag.txt' on the target server.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Dockerfile, README, and exploit script for an educational lab simulating CVE-2025-29306. The exploit script sends a serialized payload to a target URL to read a flag file, which is consistent with the described vulnerability demonstration. No concealed backdoor, persistence, credential theft, or unrelated payload is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The file exploit.sh is a script that actively sends a malicious payload to a target server to achieve remote code execution, which is the definition of an exploit.
exploit.sh:1-16Requirements
- A running instance of the vulnerable Docker container, accessible at the target URL.
README.md:9-10
Observed behavior
- Sends an HTTP GET request with a URL-encoded serialized PHP payload in the 'id' parameter to the target endpoint.
exploit.sh:12-14 - The serialized payload is designed to execute the system command 'cat /opt/flag.txt' upon deserialization.
exploit.sh:7
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the core exploit behavior for the stated CVE-2025-29306 educational lab, not a backdoor.
exploit.sh:7-14
What the analysis did not establish
- The evidence does not include the vulnerable PHP source code (index.php) that would receive and deserialize the payload.
- The artifact is explicitly described as an 'educational lab' and a 'minimal, intentionally vulnerable educational replica — not FoxCMS itself'.
- The analysis is based solely on the provided text files; the exploit script was not executed, and its effectiveness is not verified.
- Two files (public/images/index.php and entrypoint.sh) are present in the repository inventory but their content is not included in the evidence packet. The analysis is limited to the three supplied text files.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubamalpvatayam67/day05-grafana-sqlexpr-lab
Repository PoCStars: 0Created 2025-09-13ExploitCVE-2024-92647 files
Analysis
Technical assessment
A bash script that authenticates to a Grafana instance and sends a crafted SQL expression query to the DuckDB backend to read a local file, demonstrating the CVE-2024-9264 vulnerability.
Backdoor review
No backdoor observed in reviewed code
The repository provides a Docker-based lab environment and a proof-of-concept exploit script for CVE-2024-9264, a Grafana SQL Expressions command injection and local file inclusion vulnerability. The Dockerfile builds a vulnerable Grafana instance with DuckDB installed, and the exploit script demonstrates reading a local file via the SQL Expressions API. No backdoor, deceptive payload, or concealed operator-directed harm is present in the reviewed text files.
Classification basis and observed behavior
Classification basis
The script payload withheld actively exercises the CVE-2024-9264 vulnerability by sending a malicious SQL expression to the Grafana server to read a local file, which constitutes exploitation rather than mere detection or scanning.
exploit.sh:1-36README.md:3-5Requirements
- A running Grafana instance with the SQL Expressions feature enabled and the DuckDB binary in the server's PATH.
Dockerfile:1-20README.md:3-5 - Valid credentials for a user with at least VIEWER permissions on the Grafana instance.
exploit.sh:5-6exploit.sh:10-13
Observed behavior
- Authenticates to the Grafana instance at the provided base URL using supplied credentials and stores the session cookie.
exploit.sh:10-13 - Constructs a JSON payload containing a SQL expression query that uses the DuckDB function read_text() to read a specified file from the server's filesystem.
exploit.sh:17-28 - Sends the payload to the Grafana API endpoint /api/ds/query, which forwards the expression to the DuckDB binary for execution.
exploit.sh:31-33 - Extracts and prints the contents of the target file from the API response, specifically looking for a pattern matching 'FLAG{...}'.
exploit.sh:35-36
Behaviors behind the backdoor verdict
Observables
- Exploit Script
- Payload withheldThe script authenticates to Grafana and sends a SQL expression containing 'SELECT read_text('$TARGET_FILE')' to the /api/ds/query endpoint, demonstrating the local file inclusion aspect of CVE-2024-9264.
exploit.sh:1-36 - Vulnerable Configuration
- Payload withheldThe Dockerfile deliberately installs the DuckDB binary required for the CVE-2024-9264 exploit to function, creating a controlled lab environment.
Dockerfile:1-40
What the analysis did not establish
- The evidence includes only three text files (Dockerfile, README.md, payload withheld) out of seven total files; four files are omitted, so the full repository content is not available for analysis.
- The analysis is based solely on static review of the provided text; the code was not executed, and its effectiveness or safety is not verified.
- Four files in the repository (total 7) were not included as text in the evidence packet; their content is unknown. The evidence envelope reports they are non-text or were omitted by the content selection rule.
- Binary files, if any, were not analyzed per the evidence policy.
- The review is limited to the supplied text content and does not verify the behavior of the Docker image or exploit script at runtime.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubamalpvatayam67/day04-nexus-4956
Repository PoCStars: 0Created 2025-09-10ExploitCVE-2024-49565 files
Analysis
Technical assessment
The artifact contains a bash script (exploit.sh) that sends crafted HTTP requests to a vulnerable Nexus Repository 3 instance to read arbitrary files, including /etc/passwd and a CTF flag file, via an unauthenticated path traversal vulnerability (CVE-2024-4956).
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Dockerfile, README, and exploit script for a CVE-2024-4956 proof-of-concept. All files are plain text and contain no obfuscation, concealed executable behavior, or operator-directed harm. The Dockerfile builds a vulnerable Nexus container and copies a local entrypoint script (not supplied in the evidence). The exploit script performs path traversal requests against the local container to read /etc/passwd and a CTF flag. No backdoor, trojan, or suspicious behavior is observed in the reviewed content.
Classification basis and observed behavior
Classification basis
The exploit.sh script actively sends crafted HTTP requests to exploit a path traversal vulnerability and retrieve file contents, which is the definition of exploit code.
exploit.sh:14-19Requirements
- A running instance of Sonatype Nexus Repository 3 version 3.68.0 or earlier, accessible over the network.
Dockerfile:5README.md:4
Observed behavior
- Sends an HTTP GET request with a URL-encoded path traversal payload to read /etc/passwd from the target server.
exploit.sh:14-15 - Sends an HTTP GET request with a URL-encoded path traversal payload to read /opt/flag.txt from the target server.
exploit.sh:18-19
Behaviors behind the backdoor verdict
Observables
- Network Request
- Payload withheldExploit script performs a path traversal request to read /etc/passwd from the local Nexus container, consistent with the described CVE.
exploit.sh:15 - Network Request
- Payload withheldExploit script reads a CTF flag file from the container, consistent with the lab exercise described in the README.
exploit.sh:19 - File Reference
- Payload withheldDockerfile copies a local payload withheld script into the container. The content of this script is not included in the evidence, so its behavior cannot be reviewed.
Dockerfile:9
What the analysis did not establish
- The evidence does not include the payload withheld script referenced in the Dockerfile, so the full container setup cannot be analyzed.
- The evidence does not include the two files omitted from the packet (file_metadata_omitted: 2), so their content is unknown.
- The payload withheld script referenced in the Dockerfile is not included in the evidence; its contents are unknown and could not be reviewed.
- Two text files (total 5 files in artifact) are omitted from the evidence packet; their content is unknown.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubamalpvatayam67/day03-jenkins-23897
Repository PoCStars: 0Created 2025-09-10ExploitCVE-2024-238974 files
Analysis
Technical assessment
A bash script that exploits CVE-2024-23897 in Jenkins by using the CLI to read arbitrary files on the server, specifically /etc/passwd and /opt/flag.txt.
Backdoor review
No backdoor observed in reviewed code
The repository contains a Dockerfile, README, and exploit script for CVE-2024-23897. The Dockerfile builds a vulnerable Jenkins image and places a random flag at /opt/flag.txt. The exploit script downloads the official Jenkins CLI client and uses the documented @/path feature to read /etc/passwd and the flag. No concealed, deceptive, or operator-directed harmful behavior is present.
Classification basis and observed behavior
Classification basis
The script actively exploits the vulnerability by using the Jenkins CLI to read arbitrary files from the server, which is the core behavior of an exploit.
exploit.sh:12exploit.sh:17Requirements
- A running Jenkins instance vulnerable to CVE-2024-23897 (version <= 2.441 or LTS <= 2.426.2).
README.md:3 - Network access to the Jenkins instance.
exploit.sh:4
Observed behavior
- Downloads the Jenkins CLI client JAR from the target server.
exploit.sh:8 - Executes the CLI 'help' command with an argument '@/etc/passwd' to read the first lines of the /etc/passwd file.
exploit.sh:12 - Executes the CLI 'help' command with an argument '@/opt/flag.txt' to read the contents of a flag file.
exploit.sh:17
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThis is the documented behavior of CVE-2024-23897 and matches the PoC's stated purpose.
exploit.sh:12exploit.sh:17 - Flag Creation
- Payload withheldCreates a target for the exploit to read, consistent with a CTF or lab exercise.
Dockerfile:5-8 - External Download
- Payload withheldStandard method to obtain the CLI client for interacting with a Jenkins server; no external or unexpected endpoint is used.
exploit.sh:8
What the analysis did not establish
- One file (jenkins-cli.jar) is omitted from the text evidence, but it is downloaded at runtime and not part of the static analysis.
- One file (unclassified, 255 bytes) was omitted from text analysis per binary policy; its metadata-only inclusion does not indicate malicious content, but its contents were not reviewed.
- The review does not assess the safety of executing the provided Dockerfile or exploit script in a production environment.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
GitHubamalpvatayam67/day01-sessionreaper-lab
Repository PoCStars: 0Created 2025-09-10ExploitCVE-2025-542367 files
Analysis
Technical assessment
The artifact is an educational lab that simulates CVE-2025-54236. It includes an exploit.sh script that sends a crafted JSON POST request to a vulnerable endpoint to execute a command and read a flag file.
Backdoor review
No backdoor observed in reviewed code
The reviewed text files (Dockerfile, README.md, exploit.sh) constitute a minimal educational lab that simulates the CVE-2025-54236 vulnerability. The exploit.sh script sends a crafted JSON payload to a local service endpoint to read a flag file, which is consistent with the stated educational purpose. No concealed executable behavior, persistence, credential theft, or unrelated remote access is present in the supplied evidence.
Classification basis and observed behavior
Classification basis
The exploit.sh script is designed to send a malicious payload to a vulnerable service, which is the definition of exploit code. The README.md explicitly states it is a lab to simulate the vulnerability and directs users to use the exploit script.
exploit.sh:1-9README.md:3README.md:14Requirements
- The vulnerable Docker container must be built and running.
README.md:8-10
Observed behavior
- Sends a POST request with a JSON body containing a nested 'payload.cmd' field to execute 'cat /opt/flag.txt' on the target server.
exploit.sh:5-8
Behaviors behind the backdoor verdict
Observables
- Exploit Script
- Payload withheldThis is the core PoC demonstrating the vulnerability; it targets a local service and reads a flag file, which aligns with the educational lab description.
exploit.sh:5-9
What the analysis did not establish
- The vulnerable server-side code (e.g., public/api/service.php) is not included in the evidence, so the exact vulnerability mechanism cannot be confirmed.
- The evidence is an educational simulation, not the actual Adobe Commerce exploit.
- 4 files (including the PHP service code at public/api/service.php) are omitted from the evidence; their content is unknown and could contain backdoor behavior not visible in the reviewed files.
- Binary files are flagged as metadata-only and not analyzed; any embedded payloads would not be detected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.