Tagoletta/CVE-2025-69459

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that sends HTTP requests to create an admin account on a vulnerable Movie Rating System 1.0 instance and then logs in with the created credentials.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a single Python script (CVE-2025-69459.py) and a README.md file. The Python script is a proof-of-concept exploit for CVE-2025-69459, which creates an admin account on a vulnerable Movie Rating System instance and then logs in. The script performs only the described exploit actions: it sends a POST request to create a user with hardcoded credentials ('tago'/'tagoletta') and then logs in. No backdoor, persistence, credential exfiltration, or unrelated payload behavior is observed. The script does not connect to any external attacker-controlled server, does not download or execute additional code, and does not modify the local system. The README.md contains only links to a write-up and an Exploit-DB entry. There is no obfuscation, no concealed behavior, and no deceptive functionality.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareMovie Rating System 1.0
Attack typesbroken access controlprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively creates an admin account and logs in, which constitutes exploitation of the broken access control vulnerability rather than mere detection or scanning.

CVE-2025-69459.py:13-24CVE-2025-69459.py:28-39

Requirements

  • Target URL of a Movie Rating System 1.0 instanceCVE-2025-69459.py:4

Observed behavior

  • Sends a multipart/form-data POST request to /classes/Users.php?f=save to create a new admin user with hardcoded credentials (Username: tago, Password: tagoletta)CVE-2025-69459.py:10-24
  • If the account creation succeeds (HTTP 200), sends a second POST request to /classes/Login.php?f=login to authenticate with the newly created credentialsCVE-2025-69459.py:26-39
  • Parses the login response JSON and prints success or failure messagesCVE-2025-69459.py:41-49
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Credentials
Username: 'tago', Password: 'tagoletta'The PoC uses hardcoded credentials to create and authenticate an admin account on the target system. These are part of the exploit's normal operation and are not used for backdoor access to the tester's machine.CVE-2025-69459.py:10-11
Target Url Input
url = input('Url:')The script prompts the operator for a target URL, which is the expected behavior for a PoC exploit. No hardcoded attacker-controlled server is present.CVE-2025-69459.py:4
Exploit Endpoint
classes/Users.php?f=saveThe script sends a POST request to this endpoint to create an admin user, consistent with the described CVE.CVE-2025-69459.py:13
Login Endpoint
classes/Login.php?f=loginAfter account creation, the script logs in via this endpoint, which is part of the normal exploit flow.CVE-2025-69459.py:28
Review boundaries

What the analysis did not establish

  • CVE-2025-69459 record is absent from the acquired CVEList V5 dataset; classification relies solely on the repository content.
  • The script's effectiveness or safety has not been verified; analysis is based on static code review only.
  • Only the two text files (CVE-2025-69459.py and README.md) were reviewed; no other files exist in the repository according to the evidence envelope.
  • The CVE record (CVE-2025-69459) was absent from the acquired CVEList V5 dataset, so the official description could not be cross-referenced.
  • The review does not assess the safety of the linked external resources (tagmachan.com, exploit-db.com).
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1