0xCyberstan/CVE-2025-64459-Poc

GitHubRepository PoCExploit

PoC files

13 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Dockerized Python exploit for CVE-2025-64459, a SQL injection in Django's Q object via dictionary unpacking of the _connector argument. The code constructs a malicious payload, executes a vulnerable filter, and prints the generated SQL and bypassed query results.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a standard proof-of-concept for CVE-2025-64459. It demonstrates a SQL injection vulnerability in Django's Q object via dictionary unpacking. The code creates a local test environment, executes the documented exploit, and prints the resulting SQL and query results. No concealed executable behavior, persistence, credential theft, unrelated remote access, or other backdoor indicators are present.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwaredjango
Attack typessql injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains executable code that constructs a malicious payload and triggers the vulnerable code path to produce a SQL injection, demonstrating actual exploitation rather than just detection or analysis.

CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:9-10CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:24-28

Requirements

  • Django application using Q(**user_input) or filter(**user_input) with unsanitized user-controlled dictionary keysCVE-2025-64459-PoC/app/webapp/management/commands/poc.py:9

Observed behavior

  • Creates test users in the databaseCVE-2025-64459-PoC/app/webapp/management/commands/poc.py:17-19
  • Constructs a malicious dictionary with _connector key set to ') OR 1=1 OR ('CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:24-28
  • Passes the malicious dictionary to Q(**search_dict) and executes a filter queryCVE-2025-64459-PoC/app/webapp/management/commands/poc.py:9-10
  • Prints the generated SQL query showing injected OR 1=1 clauseCVE-2025-64459-PoC/app/webapp/management/commands/poc.py:37-40
  • Prints query results, demonstrating filter bypass and exposure of admin userCVE-2025-64459-PoC/app/webapp/management/commands/poc.py:44-50
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Demonstration
The PoC script (poc.py) constructs a malicious dictionary with a '_connector' key and passes it to Q(**search_dict) to trigger SQL injection.This is the documented CVE-2025-64459 exploit behavior and is not a backdoor.CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:24-28
Local Environment Setup
The PoC uses a local SQLite database and an insecure SECRET_KEY, typical for a disposable test environment.These settings are consistent with a local PoC and do not indicate a backdoor.CVE-2025-64459-PoC/app/sqli/settings.py:3CVE-2025-64459-PoC/app/sqli/settings.py:27
Review boundaries

What the analysis did not establish

  • Two Python __init__.py files are listed as unavailable as text, but they are typically empty and unlikely to affect classification.
  • The evidence does not include the Dockerfile or requirements.txt, so the exact vulnerable Django version cannot be confirmed from the provided files.
  • Two empty __init__.py files were not included as text but are standard Python package markers and unlikely to contain behavior.
  • Seven additional files (e.g., models.py, apps.py, Dockerfile, requirements.txt) were omitted from the text evidence; their content is unknown but the included files show no backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

CVE-2025-64459-PoC/docker-compose.yml

Created Vuln labCVE-2025-64459Compose · builds

1 Compose manifest · 1 Dockerfile · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Dockerized Django 5.1 application that demonstrates a SQL injection vulnerability via Q object dictionary unpacking, as described in the README.

README.md:1-125CVE-2025-64459-PoC/docker-compose.yml:1-4CVE-2025-64459-PoC/Dockerfile:1-8

Lab assessment

Vulnerability lab

The README explicitly states it is a Proof of Concept for CVE-2025-64459, a Django ORM SQL injection. The Dockerfile builds a vulnerable Django 5.1 environment and runs a management command (poc.py) that demonstrates the exploit.

README.md:1-5CVE-2025-64459-PoC/Dockerfile:1-8CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:1-52
Lab shapeCompose · builds
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

cve-poc service

vulnerable Django application container

A single service built from the local Dockerfile. It runs Django 5.1 with a custom 'webapp' app and executes the poc.py management command on startup to demonstrate the SQL injection.

CVE-2025-64459-PoC/docker-compose.yml:1-4CVE-2025-64459-PoC/Dockerfile:1-8

poc.py management command

exploit demonstrator

A Django management command that sets up test users, constructs a malicious payload with a '_connector' key, passes it to Q(**search_dict), and prints the resulting SQL and query results to show filter bypass.

CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:1-52

Django ORM (Q object)

vulnerable component

The Q object in Django 5.1 is used with dictionary unpacking, allowing an attacker to inject a '_connector' key that alters the SQL WHERE clause logic, as described in the README and demonstrated in poc.py.

README.md:27-45CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:5-8
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-64459

Supported by supplied evidence

The README describes the vulnerability as SQL injection via Q object unpacking, and the poc.py script explicitly demonstrates this by using a malicious '_connector' payload to bypass a filter, matching the CVE description.

README.md:1-5CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:5-8CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:22-52
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.README.md:57-59
  • Clone the repository and navigate to the CVE-2025-64459-PoC directory.README.md:62-65

Evidence-described exercise path

  1. Run 'docker-compose up --build' to build the image and start the container.README.md:68-70
  2. The container executes the poc.py management command, which creates test users, simulates a malicious request, and prints the generated SQL and results.CVE-2025-64459-PoC/Dockerfile:8CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:13-52
  3. Observe the output for the success message indicating filter bypass and admin user exposure.README.md:73-82
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The container runs only a self-contained Django management command that creates local test users and prints SQL. There are no exposed ports, no volume mounts, no privileged mode, and no network calls to external systems. All behavior is confined to the lab's own target.

CVE-2025-64459-PoC/docker-compose.yml:1-4CVE-2025-64459-PoC/Dockerfile:1-8CVE-2025-64459-PoC/app/webapp/management/commands/poc.py:1-52
Review boundaries

What the analysis did not establish

  • The CVE-2025-64459 identifier is not present in the acquired CVE list; it is only claimed by the repository author.
  • The README mentions affected versions but the requirements.txt pins only Django==5.1, which may not be a vulnerable version if 5.1.14 is already released; the lab does not verify the exact vulnerable version.
  • No network exposure or external interaction is configured, so the exploit is demonstrated only locally within the container.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1