rxerium/CVE-2025-53072-CVE-2025-62481

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Nuclei template (referenced but not included) and README documentation for detecting Oracle E-Business Suite instances likely vulnerable to CVE-2025-53072 and CVE-2025-62481 by checking the Last-Modified header date against the patch date and identifying the home page content.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists solely of a README.md file describing a Nuclei template for detecting vulnerable Oracle E-Business Suite instances. The text contains no executable code, no obfuscated payloads, no instructions to download or run anything beyond the publicly available Nuclei scanner, and no deceptive behavior. The README provides documentation, usage instructions, references, a disclaimer, and contact information, all of which are consistent with a legitimate proof-of-concept detection script.

ClassificationScanner
Model confidence98%
AuthenticationNot required
Languagesyaml
Target softwareOracle E-Business SuiteOracle Marketing
Attack typesdetection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact describes a Nuclei template that checks for vulnerability indicators (Last-Modified header date, page content) without performing any exploitation actions. The README explicitly states it is a 'script to fingerprint devices that are "likely" vulnerable... not confirmed vulnerable', which is characteristic of a scanner.

README.md:7

Requirements

  • Nuclei scanner must be installed.README.md:11
  • Target Oracle E-Business Suite instance must be network accessible via HTTP.README.md:15

Observed behavior

  • Sends HTTP requests to the target to retrieve the Last-Modified header and page content.README.md:7
  • Checks if the Last-Modified header indicates a build date before October 21, 2025.README.md:7
  • Identifies the E-Business Suite home page content and a 200 status response.README.md:7
  • Reports instances that are likely vulnerable based on the header and content checks.README.md:7
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Contact Method
Signal link: https://signal.me/#eu/0Qd68U1ivXNdWCF4hf70UYFo7tB0w-GQqFpYcyV6-yr4exn2SclB6bFeP7wTAxQwThe README provides a Signal contact link for questions about the detection script. This is a standard practice in security research and does not constitute a backdoor or malicious instruction.README.md:46
Social Media Link
Twitter/X: https://x.com/rxerium, LinkedIn: https://www.linkedin.com/in/rxerium/The README includes links to the author's social media profiles. This is normal for open-source projects and does not indicate malicious intent.README.md:48
Review boundaries

What the analysis did not establish

  • The actual Nuclei template file (template.yaml) is not included in the evidence; only the README.md is provided.
  • The evidence packet reports complete_artifact_coverage as false, indicating not all files from the repository are present.
  • Only the README.md file content was provided; two other files in the repository (totaling 2278 bytes) were omitted and classified as unclassified. Their content is unknown, but the analysis routing indicates no executable source was identified in the artifact.
  • The actual Nuclei template file (template.yaml) referenced in the README is not included in the evidence, so its contents cannot be reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2