Piotr Bazydlo

Classification basis

The module is a complete exploit that actively uploads and executes a payload on a vulnerable target. It constructs a malicious request with directory traversal, delivers a web shell or cron-based command execution, and triggers the payload to gain a session. This matches the 'exploit' classification as code intended to exercise a vulnerability for remote code execution.

Requirements

• Target must be running a vulnerable version of SmarterMail (before 100.0.9413).modules/exploits/multi/http/smartermail_guid_file_upload.rb:20
• The /api/upload endpoint must be accessible and accept multipart POST requests.modules/exploits/multi/http/smartermail_guid_file_upload.rb:114-119

Observed behavior

• Sends a multipart POST request to /api/upload with a contextData JSON field containing a 'guid' key with directory traversal sequences (e.g., '../' repeated) to place a file outside the intended upload directory.modules/exploits/multi/http/smartermail_guid_file_upload.rb:111
• On Windows, uploads an ASPX web shell that executes an attacker-supplied command via cmd.exe, then triggers it with an HTTP GET request.modules/exploits/multi/http/smartermail_guid_file_upload.rb:79-97modules/exploits/multi/http/smartermail_guid_file_upload.rb:135-142
• On Unix, uploads a raw command payload to /tmp and writes a cron job to /etc/cron.d that executes the payload every minute.modules/exploits/multi/http/smartermail_guid_file_upload.rb:144-156

Observables

Exploit Behavior

Payload withheldConsistent with module description of uploading a malicious ASPX web shell to the web root for RCE.modules/exploits/multi/http/smartermail_guid_file_upload.rb:133-136

Exploit Behavior

Payload withheldConsistent with module description of leveraging the upload vulnerability for RCE; cron job executes the uploaded payload.modules/exploits/multi/http/smartermail_guid_file_upload.rb:144-156

Exploit Behavior

Payload withheldMatches the CVE description of unsanitized guid key allowing directory traversal to upload files to arbitrary locations.modules/exploits/multi/http/smartermail_guid_file_upload.rb:111

Classification basis

The module's exploit method constructs and sends a SQL injection payload that inserts a cron job to execute an attacker-supplied command, achieving remote code execution. This is active exploitation, not just detection.

Requirements

• Target must be running a vulnerable version of FreePBX (prior to 15.0.66, 16.0.89, or 17.0.3).modules/exploits/unix/http/freepbx_unauth_sqli_to_rce.rb:17-18
• The /admin/ajax.php endpoint must be accessible without authentication.modules/exploits/unix/http/freepbx_unauth_sqli_to_rce.rb:18-19
• The FreePBX database user must have privileges to insert into the cron_jobs table.modules/exploits/unix/http/freepbx_unauth_sqli_to_rce.rb:19-20

Observed behavior

• Sends an HTTP GET request to /admin/ajax.php with a SQL injection payload in the 'brand' parameter to insert a cron job entry containing the attacker's command.modules/exploits/unix/http/freepbx_unauth_sqli_to_rce.rb:93-107
• Checks for vulnerability by sending a similar request with a single quote and inspecting the response for a MySQL syntax error.modules/exploits/unix/http/freepbx_unauth_sqli_to_rce.rb:70-84
• Cleans up by sending a SQL injection to delete the created cron job entry.modules/exploits/unix/http/freepbx_unauth_sqli_to_rce.rb:123-133

Observables

Exploit Behavior

Payload withheldThis is the declared exploit mechanism for CVE-2025-57819.modules/exploits/unix/http/freepbx_unauth_sqli_to_rce.rb:93-95

Cleanup Behavior

Payload withheldThe cleanup method removes the cron job created during exploitation, which is normal for a Metasploit module.modules/exploits/unix/http/freepbx_unauth_sqli_to_rce.rb:131

Classification basis

The artifact is a complete Metasploit exploit module that implements a multi-step attack chain to achieve remote code execution. It includes code to leak credentials, bypass authentication, inject commands, and execute arbitrary payloads on the target.

Requirements

• Target must be a vulnerable Commvault instance (versions <= 11.32.101 or <= 11.36.59).modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:1
• The target must be running on Windows.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:437-439

Observed behavior

• Leaks the PublicSharingUser GUID password via an unauthenticated endpoint.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:84-100
• Authenticates as PublicSharingUser and leaks the target hostname and OS.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:137-181
• Bypasses authentication to obtain a localadmin token via command-line argument injection.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:237-254
• Leaks the full installation path using an authenticated API.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:256-268
• Uploads an XML file, injects an expression language payload into the localadmin user description, moves the XML file to a JSP web shell, and triggers remote code execution.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:307-394
• Cleans up the injected user description and registers the web shell for cleanup.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:384-393

Observables

Credential Leakage

Payload withheldPart of the documented exploit chain (CVE-2025-57788) to gain initial low-privilege access.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:94-95

Authentication Bypass

Payload withheldImplements CVE-2025-57791 to escalate privileges to localadmin.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:247-252

Remote Code Execution

Payload withheldImplements CVE-2025-57790 to achieve RCE; payload is the user-supplied Metasploit payload.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:310modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:490

Cleanup Mechanism

Payload withheldModule attempts to restore the modified user description and registers the web shell for deletion, consistent with normal Metasploit post-exploitation cleanup.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:375modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:384-392

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises the vulnerability by uploading a malicious file and executing it to gain a session. It includes authentication, file upload, and trigger logic, which constitutes exploitation, not just detection or analysis.

Requirements

• Target must be running a vulnerable version of Sitecore PowerShell Extensions (through 7.0) on Sitecore XP 10.0.0 to 10.4.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:79
• The module authenticates using hardcoded credentials for the ServicesAPI account (username 'ServicesAPI', password 'b') via CVE-2025-34509.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:61modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:119

Observed behavior

• Authenticates to the target Sitecore instance using the hardcoded ServicesAPI credentials.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:61modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:119
• Generates a payload executable and wraps it in an ASPX webshell.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:87-88
• Uploads the ASPX webshell via a multipart POST request to the vulnerable PowerShellUploadFile2.aspx endpoint.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:90-104
• Triggers the uploaded webshell by sending a GET request to its location, executing the payload.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:111-116

Observables

Hardcoded Credential Use

Payload withheldThe module uses hardcoded credentials to authenticate, which is part of the documented exploit chain (CVE-2025-34509). This is normal exploit behavior, not a backdoor.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:61modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:119

Payload Generation

Payload withheldThe module generates a payload executable and wraps it as an ASPX webshell, which is standard Metasploit behavior for achieving remote code execution on the target.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:87-88

File Upload Endpoint

Payload withheldThe module uploads the generated ASPX file to the vulnerable PowerShell extension endpoint, consistent with the CVE description.modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:72modules/exploits/windows/http/sitecore_xp_cve_2025_34511.rb:100

Classification basis

The artifact is a complete Metasploit exploit module that actively exercises the vulnerability by authenticating, uploading a malicious ZIP with a path traversal payload, and executing arbitrary code on the target.

Requirements

• Target must be running a vulnerable version of Sitecore (9.0-9.3, 10.0-10.4) with the hardcoded ServicesAPI credentials active.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:22modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:62modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:70-72

Observed behavior

• Authenticates to the target using hardcoded credentials ('ServicesAPI' / 'b') via the login_identitysrv method.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:62modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:340
• Elevates privileges by obtaining identity cookies via get_identity_cookies.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:66modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:344
• Navigates a multi-step upload wizard (Upload2.aspx) to prepare for a ZIP upload with the 'Unzip' option enabled.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:88-297
• Generates a malicious ZIP archive containing a path traversal filename ('//\\/../' + webshell_file) and an ASPX webshell payload.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:299-307
• Uploads the malicious ZIP via a multipart POST request, exploiting the Zip Slip vulnerability to write the webshell to an arbitrary location.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:309-325
• Triggers the uploaded webshell by sending a GET request to the webshell's URL, executing the payload.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:332-336modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:350

Observables

Hardcoded Credential

Payload withheldUsed for authentication as part of the exploit chain (CVE-2025-34509). This is the documented vulnerability, not a backdoor.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:62modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:340

Path Traversal Payload

Payload withheldThe ZIP slip path traversal writes an ASPX webshell to the web root. This is the core exploit mechanism.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:301-305

Payload Generation

Payload withheldStandard Metasploit payload generation; the resulting executable is embedded in the ASPX webshell.modules/exploits/windows/http/sitecore_xp_cve_2025_34510.rb:302-303